diff --git a/Dockerfile b/Dockerfile
index 0c34919..a5394ab 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -15,13 +15,16 @@ FROM alpine:3.21
 RUN apk --no-cache add ca-certificates
 COPY --from=builder /app/registry /registry
 
-# ── Non-secret defaults (change here → rebuild → push → redeploy) ─────────
-ENV S3_ENDPOINT=s3.msk-1.ngcloud.ru \
+# ── TEMP: reader creds hardcoded for Ceph test ────────────────────────────
+ENV S3_ENDPOINT=ceph.tst.nubes.ru \
     S3_BUCKET=terraform-registry \
     S3_PREFIX=go-registry.containerk8s.dev.nubes.ru \
     REGISTRY_HOSTNAME=go-registry.containerk8s.dev.nubes.ru \
-    PORT=5000
-# ── Secrets go in UI jsonEnv: S3_ACCESS_KEY, S3_SECRET_KEY ─────────────────
+    S3_USE_SSL=false \
+    PORT=5000 \
+    S3_ACCESS_KEY=AAYTNYSZIM08DDWV3TK1 \
+    S3_SECRET_KEY=xQVd9CeGXACPIXTBTH4KV6DIHEAyySOFSTrS17Lc
+# ── TODO: remove hardcoded keys, use jsonEnv for new instance ─────────────
 
 EXPOSE 5000
 CMD ["/registry"]
diff --git a/server/main.go b/server/main.go
index e2b9c2b..7248651 100644
--- a/server/main.go
+++ b/server/main.go
@@ -27,7 +27,7 @@ var (
 	s3Prefix   = os.Getenv("S3_PREFIX") // S3 key prefix (may differ from hostname)
 )
 
-const VERSION = "1.0.3"
+const VERSION = "1.0.4"
 
 // Terraform Registry Protocol Structs
 type Discovery struct {
@@ -91,9 +91,10 @@ func main() {
 	}
 
 	var err error
+	useSSL := os.Getenv("S3_USE_SSL") != "false"
 	s3Client, err = s3.New(endpoint, &s3.Options{
 		Creds:  credentials.NewStaticV4(accessKeyID, secretAccessKey, ""),
-		Secure: true, // Force secure for cloud S3
+		Secure: useSSL,
 	})
 	if err != nil {
 		log.Fatalln(err)