diff --git a/pmoves/docker-compose.yml b/pmoves/docker-compose.yml
index 7142fed6aa..7685f35c69 100644
--- a/pmoves/docker-compose.yml
+++ b/pmoves/docker-compose.yml
@@ -3,22 +3,46 @@
 # Each tier receives ONLY the secrets it needs (principle of least privilege)
 # =============================================================================
 x-env-tier-data: &env-tier-data
-  env_file: [ env.tier-data?, .env.local ]  # ? = optional, won't fail if missing
+  env_file:
+    - path: env.tier-data
+      required: false
+    - path: .env.local
+      required: false
 
 x-env-tier-api: &env-tier-api
-  env_file: [ env.tier-api?, .env.local ]  # ? = optional, won't fail if missing
+  env_file:
+    - path: env.tier-api
+      required: false
+    - path: .env.local
+      required: false
 
 x-env-tier-worker: &env-tier-worker
-  env_file: [ env.tier-worker?, .env.local ]  # ? = optional, won't fail if missing
+  env_file:
+    - path: env.tier-worker
+      required: false
+    - path: .env.local
+      required: false
 
 x-env-tier-agent: &env-tier-agent
-  env_file: [ env.tier-agent?, .env.local ]  # ? = optional, won't fail if missing
+  env_file:
+    - path: env.tier-agent
+      required: false
+    - path: .env.local
+      required: false
 
 x-env-tier-media: &env-tier-media
-  env_file: [ env.tier-media?, .env.local ]  # ? = optional, won't fail if missing
+  env_file:
+    - path: env.tier-media
+      required: false
+    - path: .env.local
+      required: false
 
 x-env-tier-llm: &env-tier-llm
-  env_file: [ env.tier-llm?, .env.local ]  # ? = optional, won't fail if missing
+  env_file:
+    - path: env.tier-llm
+      required: false
+    - path: .env.local
+      required: false
 
 # Legacy: Full env for services not yet migrated to tier-based
 x-env-legacy: &env-legacy
@@ -49,7 +73,7 @@ services:
     image: postgrest/postgrest:latest
     restart: unless-stopped
     depends_on: [ postgres ]
-    env_file: [ env.shared.generated, env.shared, .env.generated, .env.local ]
+    <<: *env-tier-api
     environment:
       - PGRST_DB_URI=postgres://${POSTGRES_USER:-pmoves}:${POSTGRES_PASSWORD:-pmoves}@postgres:5432/${POSTGRES_DB:-pmoves}
       - PGRST_DB_SCHEMA=${PGRST_DB_SCHEMA:-public,pmoves_core}
@@ -170,7 +194,7 @@ services:
   retrieval-eval:
     build: ./services/retrieval-eval
     restart: unless-stopped
-    env_file: [ env.shared.generated, env.shared, .env.generated, .env.local ]
+    <<: *env-tier-api
     environment:
       - HIRAG_URL=http://hi-rag-gateway-v2:8086
       - EVAL_HTTP_PORT=${EVAL_HTTP_PORT:-8090}
@@ -187,7 +211,7 @@ services:
   presign:
     build: ./services/presign
     restart: unless-stopped
-    env_file: [ env.shared.generated, env.shared, .env.generated, .env.local ]
+    <<: *env-tier-api
     environment:
       - MINIO_ENDPOINT=${MINIO_ENDPOINT:-minio:9000}
       - MINIO_ACCESS_KEY=${MINIO_ACCESS_KEY}
diff --git a/pmoves/env.tier-api.example b/pmoves/env.tier-api.example
new file mode 100644
index 0000000000..c0cb61406e
--- /dev/null
+++ b/pmoves/env.tier-api.example
@@ -0,0 +1,42 @@
+# =============================================================================
+# PMOVES API Tier Environment Variables
+# =============================================================================
+# Services: postgrest, presign, retrieval-eval, hi-rag-gateway-v2
+# Scope: Data tier URLs, internal service credentials (NO external API keys)
+#
+# Copy to `env.tier-api` and fill in real values. The file is gitignored.
+# =============================================================================
+
+# PostgreSQL Connection (for PostgREST)
+POSTGRES_USER=pmoves
+# REQUIRED: Must match env.tier-data POSTGRES_PASSWORD
+POSTGRES_PASSWORD=
+POSTGRES_DB=pmoves
+PGRST_DB_SCHEMA=public,pmoves_core
+PGRST_DB_ANON_ROLE=anon
+PGRST_SERVER_PORT=3000
+# REQUIRED: Generate with `openssl rand -base64 32`
+SUPABASE_JWT_SECRET=
+
+# MinIO Connection (for Presign)
+MINIO_ENDPOINT=minio:9000
+# REQUIRED: Must match env.tier-data MINIO credentials
+MINIO_ACCESS_KEY=
+MINIO_SECRET_KEY=
+MINIO_SECURE=false
+AWS_DEFAULT_REGION=us-east-1
+ALLOWED_BUCKETS=assets,outputs
+# REQUIRED: Generate with `openssl rand -hex 32`
+PRESIGN_SHARED_SECRET=
+
+# Hi-RAG Gateway (for retrieval-eval)
+HIRAG_URL=http://hi-rag-gateway-v2:8086
+EVAL_HTTP_PORT=8090
+
+# Qdrant Connection (for Hi-RAG)
+QDRANT_URL=http://qdrant:6333
+QDRANT_COLLECTION=pmoves_chunks_qwen3
+
+# Meilisearch Connection (for Hi-RAG)
+# REQUIRED: Must match env.tier-data MEILI_MASTER_KEY
+MEILI_MASTER_KEY=