diff --git a/README.md b/README.md
index 2212254..4ad0094 100644
--- a/README.md
+++ b/README.md
@@ -90,7 +90,7 @@ Requirements: Node ≥ 20.10 (22 recommended), npm ≥ 10.
 ```bash
 npm install
 
-# against a real Stalwart (default: mail.example.com, change STALWART_URL in .env or the environment)
+# against a real Stalwart (set STALWART_URL in .env or the environment)
 npm run dev            # server on :8080 (tsx watch) + Vite dev server on :5173 (proxying /api)
 
 # against the built-in mock Stalwart (demo@example.com / demo) — no real mailbox needed
@@ -127,7 +127,7 @@ Press `?` anywhere. Highlights: `c` compose · `/` search · `j`/`k` navigate ·
 
 ## Known issues / pending QA
 
-Verified against the mock server and, for the core mail flows, against a live Stalwart 1.0 (`mail.example.com`). Still pending live verification:
+Verified against the mock server and, for the core mail flows, against a live Stalwart 1.0. Still pending live verification:
 
 - **HTML signatures** — Stalwart caps identity signatures at 2 KB. ihasmail compacts pasted HTML, moves images to Files and, if still too large, keeps the full signature in Files behind a short marker (other clients see a text fallback). The end-to-end flow (save → compose → send with inline logo) is implemented but not yet confirmed on the live server.
 - **Files** — the live server runs an older Stalwart build than `main`; `FileNode/query` there rejects `isTopLevel`/`parentId` filters, so ihasmail falls back to listing all nodes and building the tree client-side. Upload/rename/move/delete still need a live pass.
diff --git a/docker-compose.yml b/docker-compose.yml
index 2c1ddbb..753411f 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -6,7 +6,7 @@ services:
     ports:
       - "8080:8080"
     environment:
-      STALWART_URL: ${STALWART_URL:-https://mail.example.com}
+      STALWART_URL: ${STALWART_URL:?set STALWART_URL in .env}
       APP_SECRET: ${APP_SECRET:?set APP_SECRET in .env (openssl rand -base64 48)}
       APP_NAME: ${APP_NAME:-ihasmail}
       TRUST_PROXY: "1"