diff --git a/Dockerfile b/Dockerfile
index 565532b..61e847c 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -15,16 +15,15 @@ FROM alpine:3.21
 RUN apk --no-cache add ca-certificates
 COPY --from=builder /app/registry /registry
 
-# ── TEMP: reader creds hardcoded for Ceph test ────────────────────────────
-ENV S3_ENDPOINT=ceph.tst.nubes.ru \
+# ── Prod config (change here → rebuild → push → redeploy) ─────────────────
+ENV S3_ENDPOINT=s3.msk-1.ngcloud.ru \
     S3_BUCKET=terraform-registry \
-    S3_PREFIX=registry.containerk8s.dev.nubes.ru \
-    REGISTRY_HOSTNAME=registry.containerk8s.dev.nubes.ru \
-    S3_USE_SSL=false \
+    S3_PREFIX=tf-registry.services.ngcloud.ru \
+    REGISTRY_HOSTNAME=tf-registry.services.ngcloud.ru \
     PORT=5000 \
-    S3_ACCESS_KEY=AAYTNYSZIM08DDWV3TK1 \
-    S3_SECRET_KEY=xQVd9CeGXACPIXTBTH4KV6DIHEAyySOFSTrS17Lc
-# ── TODO: remove hardcoded keys, use jsonEnv for new instance ─────────────
+    S3_ACCESS_KEY=6DDP5PKQEE37WLSWXP07 \
+    S3_SECRET_KEY=W0vV4YNeHIqMa2sRCXsR61ZuQfAJIZzVj2VgnBrT
+# ── Reader-креды (1112_terraform:reader), убрать когда jsonEnv в modify ───
 
 EXPOSE 5000
 CMD ["/registry"]