diff --git a/CHANGELOG.md b/CHANGELOG.md
index 5907324..3bebad7 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,5 +1,11 @@
 # Changelog
 
+## [Backend 0.6.7] - 2026-08-20
+
+### Changed
+
+- Docker Compose now injects backend configuration from the untracked `backend/.env`; secrets are no longer hard-coded or copied into the image.
+
 ## [Backend 0.6.6] - 2026-08-19
 
 ### Fixed
diff --git a/Dockerfile.backend b/Dockerfile.backend
index 018e417..772799f 100644
--- a/Dockerfile.backend
+++ b/Dockerfile.backend
@@ -31,7 +31,6 @@ COPY --from=build /app/backend/dist ./dist
 COPY --from=build /app/backend/package.json ./package.json
 COPY --from=build /app/node_modules ./node_modules
 COPY --from=build /app/backend/node_modules/ ./node_modules/
-COPY backend/.env .env
 
 EXPOSE 3000
 CMD ["node","dist/app.js"]
diff --git a/backend/README.md b/backend/README.md
index 2d273c1..955e7b3 100644
--- a/backend/README.md
+++ b/backend/README.md
@@ -21,6 +21,8 @@ createdb family_budget
 npm run dev -w backend
 ```
 
+Для Docker Compose production-переменные передаются из `backend/.env`. Файл не хранится в Git и не копируется в Docker image; перед запуском создайте его из `.env.example` и заполните секреты.
+
 Сервер стартует на `http://localhost:3000` (или на порту из `PORT`).
 
 ## Скрипты
diff --git a/backend/package.json b/backend/package.json
index b280c9b..f182dd5 100644
--- a/backend/package.json
+++ b/backend/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@family-budget/backend",
-  "version": "0.6.6",
+  "version": "0.6.7",
   "private": true,
   "scripts": {
     "dev": "tsx watch src/app.ts",
diff --git a/docker-compose.yml b/docker-compose.yml
index befdfb3..0d71a10 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -7,13 +7,8 @@ services:
       context: .
       dockerfile: Dockerfile.backend
     container_name: family-budget-backend
-    environment:
-      # Имя контейнера/сервиса PostgreSQL — postgres или postgres_budget
-      - DB_HOST=postgres_budget
-      - DB_PORT=5432
-      - DB_NAME=family_budget
-      - DB_USER=budget_user
-      - DB_PASSWORD=difficult_Paaaaaasword
+    env_file:
+      - ./backend/.env
     ports:
       - "3000:3000"
     restart: unless-stopped