diff --git a/docker-compose.yml b/docker-compose.yml
index 17ae275..a6d35ee 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -24,6 +24,10 @@ services:
       # Dedicated ledger-signing key. Falls back to JWT_SECRET (with a warning) if empty;
       # set a distinct one in prod. See apps/server/.env.example + local-jwt-auth.
       EVENT_SIGNING_KEY: ${EVENT_SIGNING_KEY:-}
+      # Dedicated backup-ENCRYPTION key (separate from the signing key). Empty = backups stay
+      # off (the in-UI target + retention do nothing without it). Per-booth + unique; escrow it
+      # offsite. See apps/server/.env.example + wiki/concepts/backup-recovery.md.
+      BACKUP_KEY: ${BACKUP_KEY:-}
       # CRITICAL on the plain-HTTP booth LAN: cookies are Secure (HTTPS-only) by DEFAULT,
       # so without COOKIE_SECURE=0 the auth cookie is never sent over http and operators
       # CANNOT LOG IN. Leave unset only behind TLS. See disk-os-hardening "deploy-time runbook".