diff --git a/.gitignore b/.gitignore
index c8c9347..8c28494 100644
--- a/.gitignore
+++ b/.gitignore
@@ -2,4 +2,5 @@ __pycache__/
 *.pyc
 
 server/log.txt
+server/.env
 cookies.txt
diff --git a/README.md b/README.md
index 6852b0d..8332b76 100644
--- a/README.md
+++ b/README.md
@@ -207,15 +207,17 @@ Use a Netscape-format cookie exporter, then point `--cookies` / `$YTDLP_COOKIES`
    ./musicfetch --repair --cookies ~/cookies.txt -o /media/music
    ```
 
-   For the API container, mount it and set the env var (see `server/docker-compose.yml`):
+   For the API container, just point it at the host file via `.env` — no compose
+   edits needed (see `server/.env.example`):
 
-   ```yaml
-   environment:
-     YTDLP_COOKIES: "/cookies.txt"
-   volumes:
-     - /host/path/cookies.txt:/cookies.txt:ro
+   ```bash
+   # server/.env
+   YTDLP_COOKIES_HOST=/host/path/cookies.txt
    ```
 
+   The compose mounts it read-only at `/cookies.txt` and sets `YTDLP_COOKIES`
+   automatically. Leave `YTDLP_COOKIES_HOST` unset to run without cookies.
+
 Cookies expire — if YouTube starts rejecting them, re-export. Treat `cookies.txt` like a
 password (it *is* your logged-in session); keep it out of git (`.gitignore` it).
 
diff --git a/server/.env.example b/server/.env.example
new file mode 100644
index 0000000..65eb270
--- /dev/null
+++ b/server/.env.example
@@ -0,0 +1,13 @@
+# Copy to server/.env and fill in. docker-compose reads it automatically.
+
+# Lidarr (preferred source)
+LIDARR_API_KEY=
+
+# API key clients must send to musicfetch-api
+MUSICFETCH_API_KEY=
+
+# Optional: authenticated YouTube cookies to dodge the bot-check
+# ("Sign in to confirm you're not a bot") and rate limits.
+# Set to the host path of a Netscape-format cookies.txt (see README
+# "Getting YouTube cookies"). Leave unset to run without cookies.
+# YTDLP_COOKIES_HOST=/host/path/cookies.txt
diff --git a/server/docker-compose.yml b/server/docker-compose.yml
index fc6678d..d74395e 100644
--- a/server/docker-compose.yml
+++ b/server/docker-compose.yml
@@ -13,10 +13,14 @@ services:
       MUSICFETCH_API_KEY: "${MUSICFETCH_API_KEY}"
       MUSICFETCH_ROOT: "/media/music"
       MUSICFETCH_PORT: "6769"
-      # Optional: authenticated YouTube cookies to avoid bot-check / rate limits.
-      # Mount a cookies.txt below and point this at it (in-container path).
-      YTDLP_COOKIES: "${YTDLP_COOKIES:-}"
+      # Optional: authenticated YouTube cookies to avoid bot-check ("Sign in to
+      # confirm you're not a bot") / rate limits. To enable, set in a .env file
+      # (see server/.env.example):
+      #   YTDLP_COOKIES_HOST=/host/path/cookies.txt
+      # The host file is mounted read-only at /cookies.txt and used automatically.
+      YTDLP_COOKIES: "${YTDLP_COOKIES_HOST:+/cookies.txt}"
     volumes:
       - /media/music:/media/music
-      # Uncomment and set host path to supply cookies (see YTDLP_COOKIES above):
-      # - /path/to/cookies.txt:/cookies.txt:ro
+      # Cookies bind: maps to the host cookies.txt when YTDLP_COOKIES_HOST is set,
+      # otherwise /dev/null (harmless no-op so the container still starts).
+      - "${YTDLP_COOKIES_HOST:-/dev/null}:/cookies.txt:ro"