diff --git a/README.Docker.md b/README.Docker.md
index 7cfede9..58592fe 100644
--- a/README.Docker.md
+++ b/README.Docker.md
@@ -2,7 +2,7 @@ Running and debugging with Docker or local Couchbase Lite storage
 
 Quick run (Docker Engine required):
 
-1. Build and start services:
+1. Build and start services with the development override:
 
    docker compose up --build
 
@@ -11,9 +11,15 @@ Quick run (Docker Engine required):
 Production deployment:
 
 - Put deployment values in a `.env` file next to `docker-compose.yml` or export them in the shell before running Docker Compose.
+- The base compose file is runtime-only and expects the image referenced by `IMAGE_REGISTRY` and `IMAGE_TAG` to already exist.
 - The base compose file is now parameterized for host port, persisted storage path, image tag, auth mode, seeded user credentials, allowed hosts, and healthcheck timings.
 - For a direct production deployment, define at least `WORKTRACKER_DATA_PATH`. If you enable the built-in login flow, also define `APPAUTH_ENABLED=true` and a strong `SINGLEUSER_PASSWORD` before first startup.
 
+Production start:
+
+- Copy `docker-compose.yml` and the matching env file to the server.
+- Pull the published image first, then start the stack with `docker compose --env-file production.env up -d`.
+
 Deployment variables:
 
 | Variable | Required for production | Default | Purpose |
@@ -104,5 +110,6 @@ Docker Playwright smoke tests:
 Notes:
 
 - The base compose file remains production-oriented; the override file is the optional containerized development layer.
+- `docker compose up --build` still works locally because Docker Compose auto-loads `docker-compose.override.yml`, which carries the build settings.
 - The first container build takes longer because the dev image installs the .NET debugger.
 - The Dockerfile uses the .NET 10 `*-noble` images so local builds and container builds stay aligned with the SDK available in VS Code.
diff --git a/docker-compose.yml b/docker-compose.yml
index 981a99f..9763b6f 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -1,8 +1,5 @@
 services:
   worktracker:
-    build:
-      context: .
-      dockerfile: Dockerfile
     image: ${IMAGE_REGISTRY:-worktracker}:${IMAGE_TAG:-latest}
     environment:
       ASPNETCORE_ENVIRONMENT: ${ASPNETCORE_ENVIRONMENT:-Production}
diff --git a/production.env b/production.env
index 592616c..5bfd2a2 100644
--- a/production.env
+++ b/production.env
@@ -10,10 +10,10 @@ WORKTRACKER_DATA_PATH=/mnt/storage/data/worktracker/db
 COUCHBASELITE_DATABASE_NAME=worktracker
 
 # Published app port
-WORKTRACKER_PORT=8002
+WORKTRACKER_PORT=8003
 
 # Image reference used by Docker Compose
-IMAGE_REGISTRY=worktracker
+IMAGE_REGISTRY=forgejo.maddoscientisto.net/maddo/worktracker
 IMAGE_TAG=latest
 
 # Built-in authentication
@@ -22,7 +22,7 @@ APPAUTH_DEFAULT_USERNAME=Admin
 APPAUTH_DEFAULT_USERID=ADMIN
 SINGLEUSER_SEED_ON_STARTUP=true
 SINGLEUSER_USERNAME=admin
-SINGLEUSER_PASSWORD=disagio-spaghetti-science-adsfg
+SINGLEUSER_PASSWORD=disagio
 
 # Container healthcheck tuning
 WORKTRACKER_HEALTHCHECK_INTERVAL=30s