diff --git a/apps/web/.env.example b/apps/web/.env.example
index 31eb312095..b13db05568 100644
--- a/apps/web/.env.example
+++ b/apps/web/.env.example
@@ -1,6 +1,17 @@
-DATABASE_URL="postgresql://postgres:password@localhost:5432/inboxzero?schema=public"
-DIRECT_URL="postgresql://postgres:password@localhost:5432/inboxzero?schema=public"
-NEXT_PUBLIC_BASE_URL=http://localhost:3000
+# =============================================================================
+# Docker Auto-Configured Variables
+# These are automatically set by docker-compose.yml when using Docker.
+# Only uncomment if running locally without Docker (e.g., pnpm dev).
+# =============================================================================
+# DATABASE_URL="postgresql://postgres:password@localhost:5432/inboxzero?schema=public"
+# DIRECT_URL="postgresql://postgres:password@localhost:5432/inboxzero?schema=public"
+# NEXT_PUBLIC_BASE_URL=http://localhost:3000
+# NEXT_PUBLIC_BYPASS_PREMIUM_CHECKS=true
+# UPSTASH_REDIS_URL="http://localhost:8079"
+
+# =============================================================================
+# Required Configuration
+# =============================================================================
 
 AUTH_SECRET= # openssl rand -hex 32
 
@@ -20,9 +31,6 @@ MICROSOFT_CLIENT_ID=
 MICROSOFT_CLIENT_SECRET=
 MICROSOFT_WEBHOOK_CLIENT_STATE= # openssl rand -hex 32
 
-# Disable premium
-NEXT_PUBLIC_BYPASS_PREMIUM_CHECKS=true
-
 # =============================================================================
 # LLM Configuration - Uncomment ONE provider block
 # =============================================================================
@@ -78,18 +86,26 @@ NEXT_PUBLIC_BYPASS_PREMIUM_CHECKS=true
 # ECONOMY_LLM_MODEL=llama-3.1-8b-instant
 # GROQ_API_KEY=
 
+# =============================================================================
+# Internal API Keys
+# =============================================================================
+
 INTERNAL_API_KEY= # openssl rand -hex 32
 API_KEY_SALT= # openssl rand -hex 32
 
-#redis config
-UPSTASH_REDIS_URL="http://localhost:8079"
+# =============================================================================
+# Redis Configuration
+# =============================================================================
+
 UPSTASH_REDIS_TOKEN= # openssl rand -hex 32
 REDIS_URL= # used for subscriptions: rediss://:password@host:port
 QSTASH_TOKEN=
 QSTASH_CURRENT_SIGNING_KEY=
 QSTASH_NEXT_SIGNING_KEY=
 
-# Everything below is optional:
+# =============================================================================
+# Everything below is optional
+# =============================================================================
 
 LOG_ZOD_ERRORS=true
 CRON_SECRET= # cron disabled if not set
diff --git a/docker-compose.yml b/docker-compose.yml
index cd4ab0bfbd..9bf3833570 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -76,7 +76,7 @@ services:
       - inbox-zero-network
     environment:
       NEXT_PUBLIC_BASE_URL: ${NEXT_PUBLIC_BASE_URL:-http://localhost:3000}
-      NEXT_PUBLIC_BYPASS_PREMIUM_CHECKS: ${NEXT_PUBLIC_BYPASS_PREMIUM_CHECKS:-false}
+      NEXT_PUBLIC_BYPASS_PREMIUM_CHECKS: ${NEXT_PUBLIC_BYPASS_PREMIUM_CHECKS:-true}
       DATABASE_URL: ${DATABASE_URL:-postgresql://${POSTGRES_USER:-postgres}:${POSTGRES_PASSWORD:-password}@db:5432/${POSTGRES_DB:-inboxzero}?schema=public}
       DIRECT_URL: ${DIRECT_URL:-postgresql://${POSTGRES_USER:-postgres}:${POSTGRES_PASSWORD:-password}@db:5432/${POSTGRES_DB:-inboxzero}?schema=public}
       UPSTASH_REDIS_URL: ${UPSTASH_REDIS_URL:-http://serverless-redis-http:80}
diff --git a/docs/hosting/environment-variables.md b/docs/hosting/environment-variables.md
index fb0ec5c70b..2442db3033 100644
--- a/docs/hosting/environment-variables.md
+++ b/docs/hosting/environment-variables.md
@@ -32,7 +32,7 @@ cp apps/web/.env.example apps/web/.env
 | `GOOGLE_PUBSUB_TOPIC_NAME` | Yes | Full topic name (e.g., `projects/my-project/topics/gmail`) | — |
 | `GOOGLE_PUBSUB_VERIFICATION_TOKEN` | No | Token for webhook verification | — |
 | **Redis** ||||
-| `UPSTASH_REDIS_URL` | No* | Upstash Redis URL (*required if not using Docker Compose) | — |
+| `UPSTASH_REDIS_URL` | No* | Upstash Redis URL (*required if not using Docker Compose with local Redis) | — |
 | `UPSTASH_REDIS_TOKEN` | No* | Upstash Redis token (*required if not using Docker Compose) | — |
 | `REDIS_URL` | No | Alternative Redis URL (for subscriptions) | — |
 | **LLM Provider Selection** ||||
@@ -83,7 +83,7 @@ cp apps/web/.env.example apps/web/.env
 | **Feature Flags** ||||
 | `NEXT_PUBLIC_CONTACTS_ENABLED` | No | Enable contacts feature | `false` |
 | `NEXT_PUBLIC_EMAIL_SEND_ENABLED` | No | Enable email sending | `true` |
-| `NEXT_PUBLIC_BYPASS_PREMIUM_CHECKS` | No | Bypass premium checks (recommended for self-hosting) | — |
+| `NEXT_PUBLIC_BYPASS_PREMIUM_CHECKS` | No | Bypass premium checks (recommended for self-hosting) | `true` |
 | **Debugging** ||||
 | `LOG_ZOD_ERRORS` | No | Log Zod validation errors | — |
 | `ENABLE_DEBUG_LOGS` | No | Enable debug logging | `false` |
@@ -101,5 +101,4 @@ For detailed setup instructions:
 ## Notes
 
 - If running the app in Docker and Ollama locally, use `http://host.docker.internal:11434/api` as the `OLLAMA_BASE_URL`.
-- Redis variables are required if not using Docker Compose with local Redis.
-- Set `NEXT_PUBLIC_BYPASS_PREMIUM_CHECKS=true` to unlock all features for self-hosting.
+- When using Docker Compose with `--profile all`, database and Redis URLs are auto-configured. See the [Self-Hosting Guide](./self-hosting.md) for details.
diff --git a/docs/hosting/self-hosting.md b/docs/hosting/self-hosting.md
index 3787b08baf..0e1e41449d 100644
--- a/docs/hosting/self-hosting.md
+++ b/docs/hosting/self-hosting.md
@@ -50,12 +50,14 @@ You'll need to configure:
 
 For detailed configuration instructions, see the [Environment Variables Reference](./environment-variables.md).
 
+**Note**: The first section of `.env.example` contains Docker auto-configured variables that are commented out. Leave them commented - Docker Compose sets these automatically with the correct internal hostnames.
+
 ### 4. Deploy
 
 Pull and start the services with your domain:
 
 ```bash
-NEXT_PUBLIC_BYPASS_PREMIUM_CHECKS=true NEXT_PUBLIC_BASE_URL=https://yourdomain.com docker compose --profile all up -d
+NEXT_PUBLIC_BASE_URL=https://yourdomain.com docker compose --profile all up -d
 ```
 
 The pre-built Docker image is hosted at `ghcr.io/elie222/inbox-zero:latest` and will be automatically pulled.
@@ -85,12 +87,14 @@ Wait for the containers to start, then run the database migrations:
 # Check that containers are running (STATUS should show "Up")
 docker ps
 
-# Run migrations
-docker compose exec web npx prisma migrate deploy --schema=apps/web/prisma/schema.prisma
+# Run migrations (prisma is pre-installed in the container)
+docker compose exec web prisma migrate deploy --schema=apps/web/prisma/schema.prisma
 ```
 
 **Note:** You'll need to run this command again after pulling updates to apply any new database schema changes.
 
+**Troubleshooting:** If you see `npx` trying to install a different Prisma version, run `docker compose pull web` to get the latest image which has Prisma pre-installed.
+
 ### 6. Access Your Application
 
 Your application should now be accessible at:
@@ -108,10 +112,10 @@ To update to the latest version:
 docker compose pull web
 
 # Restart with the new image
-NEXT_PUBLIC_BYPASS_PREMIUM_CHECKS=true NEXT_PUBLIC_BASE_URL=https://yourdomain.com docker compose up -d
+NEXT_PUBLIC_BASE_URL=https://yourdomain.com docker compose up -d
 
 # Run any new database migrations
-docker compose exec web npx prisma migrate deploy --schema=apps/web/prisma/schema.prisma
+docker compose exec web prisma migrate deploy --schema=apps/web/prisma/schema.prisma
 ```
 ## Monitoring
 
@@ -148,7 +152,7 @@ nano apps/web/.env
 
 # Build and start
 docker compose build
-NEXT_PUBLIC_BYPASS_PREMIUM_CHECKS=true NEXT_PUBLIC_BASE_URL=https://yourdomain.com docker compose up -d
+NEXT_PUBLIC_BASE_URL=https://yourdomain.com docker compose up -d
 ```
 
 **Note**: Building from source requires significantly more resources (4GB+ RAM recommended) and takes longer than pulling the pre-built image.