diff --git a/Dockerfile b/Dockerfile
index 61e847c..7c33182 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -15,15 +15,13 @@ FROM alpine:3.21
 RUN apk --no-cache add ca-certificates
 COPY --from=builder /app/registry /registry
 
-# ── Prod config (change here → rebuild → push → redeploy) ─────────────────
+# ── Non-secret config (change here → rebuild → push → redeploy) ─────────
 ENV S3_ENDPOINT=s3.msk-1.ngcloud.ru \
     S3_BUCKET=terraform-registry \
     S3_PREFIX=tf-registry.services.ngcloud.ru \
     REGISTRY_HOSTNAME=tf-registry.services.ngcloud.ru \
-    PORT=5000 \
-    S3_ACCESS_KEY=6DDP5PKQEE37WLSWXP07 \
-    S3_SECRET_KEY=W0vV4YNeHIqMa2sRCXsR61ZuQfAJIZzVj2VgnBrT
-# ── Reader-креды (1112_terraform:reader), убрать когда jsonEnv в modify ───
+    PORT=5000
+# ── Secrets in UI jsonEnv: S3_ACCESS_KEY, S3_SECRET_KEY ───────────────────
 
 EXPOSE 5000
 CMD ["/registry"]