diff --git a/.env.example b/.env.example
index 84f9d65..95dcf31 100644
--- a/.env.example
+++ b/.env.example
@@ -9,4 +9,4 @@ STEWARD_SMTP__PASSWORD=
 # Password for the bundled Postgres; the steward service builds its
 # STEWARD_DATABASE_URL from it. Leave STEWARD_SECRET_KEY above unset to let the
 # app generate + persist one on the /data volume.
-POSTGRES_PASSWORD=change-me
+POSTGRES_PASSWORD=steward
diff --git a/compose.deploy.yml b/compose.deploy.yml
index 2e19a38..06109f1 100644
--- a/compose.deploy.yml
+++ b/compose.deploy.yml
@@ -22,7 +22,7 @@ services:
       # source bind-mounts: core + first-party plugins live inside the image.
       - app_data:/data
     environment:
-      - STEWARD_DATABASE_URL=postgresql+asyncpg://steward:${POSTGRES_PASSWORD:-steward}@db/steward
+      - STEWARD_DATABASE_URL=postgresql+asyncpg://steward:${POSTGRES_PASSWORD}@db/steward
       # Optional: if unset, the app generates a key and persists it to
       # /data/secret.key, so sessions survive restarts via the app_data volume.
       # Set STEWARD_SECRET_KEY in .env to pin it explicitly across volume resets.
@@ -36,7 +36,7 @@ services:
     image: postgres:16-alpine
     environment:
       POSTGRES_USER: steward
-      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:-steward}
+      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD}
       POSTGRES_DB: steward
     volumes:
       - pgdata:/var/lib/postgresql/data