diff --git a/docker-compose.yml b/docker-compose.yml
index ad09851..9cbc1cf 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -68,12 +68,13 @@ services:
       - FRONTEND_URL=${FRONTEND_URL:-http://localhost:5173}
       - PYTHONDONTWRITEBYTECODE=1
       - LOG_LEVEL=${LOG_LEVEL:-INFO}
-      - LOG_JSON=${LOG_JSON:-false}
+      - LOG_JSON=${LOG_JSON:-true}
+      - CLOUD_CREDS_KEY=${CLOUD_CREDS_KEY}
     labels:
       logging: "promtail"
     extra_hosts:
       - "host.docker.internal:host-gateway"
-    command: uvicorn main:app --host 0.0.0.0 --port 8000 --reload
+    command: uvicorn main:app --host 0.0.0.0 --port 8000 --workers 2
     depends_on:
       postgres:
         condition: service_healthy
@@ -99,6 +100,7 @@ services:
       - MINIO_BUCKET=${MINIO_BUCKET}
       - REDIS_URL=${REDIS_URL}
       - CLOUD_CREDS_KEY=${CLOUD_CREDS_KEY}
+      - SECRET_KEY=${SECRET_KEY}
       - PYTHONDONTWRITEBYTECODE=1
     labels:
       logging: "promtail"
@@ -122,7 +124,6 @@ services:
     security_opt:
       - "no-new-privileges:true"
 
-  # celery-beat: NOT hardened — writes celerybeat-schedule to working directory (Phase 6 Pitfall 7).
   celery-beat:
     build: ./backend
     environment:
@@ -135,7 +136,7 @@ services:
       - PYTHONDONTWRITEBYTECODE=1
     extra_hosts:
       - "host.docker.internal:host-gateway"
-    command: celery -A celery_app beat --loglevel=info
+    command: celery -A celery_app beat --loglevel=info --schedule /tmp/celerybeat-schedule
     depends_on:
       postgres:
         condition: service_healthy
@@ -143,11 +144,18 @@ services:
         condition: service_healthy
       redis:
         condition: service_healthy
+    read_only: true
+    tmpfs:
+      - "/tmp:mode=1777"
+    cap_drop:
+      - ALL
+    security_opt:
+      - "no-new-privileges:true"
 
   loki:
     image: grafana/loki:latest
     ports:
-      - "3100:3100"
+      - "127.0.0.1:3100:3100"
     volumes:
       - ./docker/loki/loki-config.yaml:/etc/loki/local-config.yaml
       - loki_data:/loki
@@ -166,10 +174,11 @@ services:
   grafana:
     image: grafana/grafana:latest
     ports:
-      - "3000:3000"
+      - "127.0.0.1:3000:3000"
     environment:
-      - GF_AUTH_ANONYMOUS_ENABLED=true
-      - GF_AUTH_ANONYMOUS_ORG_ROLE=Admin
+      - GF_AUTH_ANONYMOUS_ENABLED=false
+      - GF_SECURITY_ADMIN_USER=${GRAFANA_ADMIN_USER:-admin}
+      - GF_SECURITY_ADMIN_PASSWORD=${GRAFANA_ADMIN_PASSWORD:-changeme}
     volumes:
       - grafana_data:/var/lib/grafana
     depends_on: