diff --git a/docker-compose.yml b/docker-compose.yml
index 73eac13e..bdf6b405 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -36,6 +36,12 @@ x-app-env: &app-env
   OTP_TTL: "1200"
   MAX_FILE_SIZE_BYTES: "5242880"
   UPLOAD_DIR: var/uploads
+  # ALTCHA self-hosted captcha. HMAC key is a secret → inject from Coolify's
+  # Environment Variables tab. Enabled in prod; tunables fixed here.
+  ALTCHA_ENABLED: "1"
+  ALTCHA_HMAC_KEY: ${ALTCHA_HMAC_KEY}
+  ALTCHA_MAX_NUMBER: "100000"
+  ALTCHA_EXPIRE_SECONDS: "300"
 
 # Shared volume mounts for services that read/write JWT keys and uploads.
 x-app-volumes: &app-volumes