diff --git a/services/vikunja/README.md b/services/vikunja/README.md
index fe9bc85..9bcdf76 100644
--- a/services/vikunja/README.md
+++ b/services/vikunja/README.md
@@ -22,7 +22,7 @@ by name so the live data survives cutover:
 ## Configuration
 
 - `config.yml` — committed, **secret-free**. Holds OIDC provider metadata.
-- `.env` — **gitignored**. Copy from `.env.example` and fill with the real
+- `.env` — **gitignored**. Copy from `env.example` and fill with the real
   live values (must be identical to the running instance):
   - `POSTGRES_PASSWORD` / `VIKUNJA_DATABASE_PASSWORD` (same value)
   - `VIKUNJA_SERVICE_JWTSECRET`
@@ -38,7 +38,7 @@ by name so the live data survives cutover:
 ## Cutover checklist
 
 1. `git pull` on PIHA.
-2. Create `services/vikunja/.env` from `.env.example` with the real values.
+2. Create `services/vikunja/.env` from `env.example` with the real values.
 3. Confirm the named volumes exist: `docker volume ls | grep vikunja_vikunja`.
 4. `docker compose -f services/vikunja/docker-compose.yml up -d`.
 5. Verify: `./healthcheck.sh` and a test OIDC login.
diff --git a/services/vikunja/docker-compose.yml b/services/vikunja/docker-compose.yml
index 6fc146e..124c153 100644
--- a/services/vikunja/docker-compose.yml
+++ b/services/vikunja/docker-compose.yml
@@ -11,6 +11,9 @@ services:
     # causing OIDC discovery to fail.
     extra_hosts:
       - "forgejo.okit.pl:192.168.31.5"
+    # Secrets are injected exclusively via env_file (.env, resolved relative to
+    # this compose file) so they work regardless of the cwd the deploy runs
+    # from — no parse-time ${} interpolation that depends on a .env in cwd.
     env_file:
       - .env
     environment:
@@ -19,31 +22,26 @@ services:
       - VIKUNJA_DATABASE_PORT=5432
       - VIKUNJA_DATABASE_USER=vikunja
       - VIKUNJA_DATABASE_DATABASE=vikunja
-      - VIKUNJA_DATABASE_PASSWORD=${VIKUNJA_DATABASE_PASSWORD:?set in .env}
       - VIKUNJA_SERVICE_PUBLICURL=https://vikunja.okit.pl
-      - VIKUNJA_SERVICE_JWTSECRET=${VIKUNJA_SERVICE_JWTSECRET:?set in .env}
-      # OIDC client secret injected from .env so config.yml stays secret-free.
-      - VIKUNJA_AUTH_OPENID_PROVIDERS_FORGEJO_CLIENTSECRET=${VIKUNJA_AUTH_OPENID_PROVIDERS_FORGEJO_CLIENTSECRET:?set in .env}
       - TZ=Europe/Warsaw
     volumes:
       - vikunja_files:/app/vikunja/files
-      - ./config.yml:/etc/vikunja/config.yml:ro
+      - ./config.yml:/app/vikunja/config.yml:ro
     ports:
       - "3456:3456"
-    healthcheck:
-      test: ["CMD", "wget", "-qO-", "http://localhost:3456/api/v1/info"]
-      interval: 30s
-      timeout: 10s
-      retries: 5
+    # No container healthcheck: the vikunja image has no wget/curl, so any
+    # in-container HTTP check is always unhealthy. Health is covered by db's
+    # pg_isready + the host-side healthcheck.sh (curl from the host).
 
   db:
     image: postgres:16-alpine
     container_name: vikunja-db
     restart: unless-stopped
+    env_file:
+      - .env
     environment:
       - POSTGRES_USER=vikunja
       - POSTGRES_DB=vikunja
-      - POSTGRES_PASSWORD=${POSTGRES_PASSWORD:?set in .env}
       - TZ=Europe/Warsaw
     volumes:
       - vikunja_db:/var/lib/postgresql/data
diff --git a/services/vikunja/.env.example b/services/vikunja/env.example
similarity index 100%
rename from services/vikunja/.env.example
rename to services/vikunja/env.example