diff --git a/.env.example b/.env.example
new file mode 100644
index 0000000..ebda3b0
--- /dev/null
+++ b/.env.example
@@ -0,0 +1,18 @@
+# Copy this file to .env and fill in your values before starting the stack.
+#   cp .env.example .env
+
+# ── MySQL ─────────────────────────────────────────────────────────────────────
+MYSQL_ROOT_PASSWORD=change_me
+MYSQL_DATABASE=eggtracker
+MYSQL_USER=eggtracker
+MYSQL_PASSWORD=change_me
+
+# ── Super admin ───────────────────────────────────────────────────────────────
+# This account is created (and its password synced) automatically on every startup.
+ADMIN_USERNAME=admin
+ADMIN_PASSWORD=change_me
+
+# ── JWT signing secret ────────────────────────────────────────────────────────
+# Generate a strong random value before deploying:
+#   openssl rand -hex 32
+JWT_SECRET=change_me