diff --git a/.env.example b/.env.example
index d84511e8..29c8525d 100644
--- a/.env.example
+++ b/.env.example
@@ -8,6 +8,11 @@
 #
 TAG=15-slim
 OPENPROJECT_HTTPS=false
+# Please override the SECRET_KEY_BASE
+# Please use a pseudo-random value for this and treat it like a password.
+# If you are on Linux you can generate a scret key with the following command
+# head /dev/urandom | tr -dc A-Za-z0-9 | head -c 32 ; echo ''
+SECRET_KEY_BASE=OVERWRITE_ME
 OPENPROJECT_HOST__NAME=localhost
 PORT=127.0.0.1:8080
 OPENPROJECT_RAILS__RELATIVE__URL__ROOT=
diff --git a/docker-compose.yml b/docker-compose.yml
index b59cf4f8..fa7f8576 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -24,6 +24,7 @@ x-op-app: &app
     RAILS_MAX_THREADS: ${RAILS_MAX_THREADS:-16}
     # set to true to enable the email receiving feature. See ./docker/cron for more options
     IMAP_ENABLED: "${IMAP_ENABLED:-false}"
+    SECRET_KEY_BASE: "${SECRET_KEY_BASE:-OVERWRITE_ME}"
   volumes:
     - "${OPDATA:-opdata}:/var/openproject/assets"