diff --git a/docker-compose.stack.yml b/docker-compose.stack.yml
index 6baba07..607c624 100644
--- a/docker-compose.stack.yml
+++ b/docker-compose.stack.yml
@@ -28,7 +28,14 @@ services:
       - ADMIN_INIT_PASSWORD=${ADMIN_INIT_PASSWORD:-}
       # M3: Session-Secret für CSRF-Token-Ableitung (Pflicht in Produktion)
       - SESSION_SECRET=${SESSION_SECRET:-}
-      - CORS_ORIGIN=${CORS_ORIGIN:-}
+      # M1: Cookie/HSTS-Sicherheit (false für plain HTTP, true hinter TLS-Proxy)
+      - COOKIE_SECURE=${COOKIE_SECURE:-false}
+      - HSTS_ENABLED=${HSTS_ENABLED:-false}
+      # H3: Massenlösch-Schutz beim LDAP-Sync (max % löschbarer AD-User pro Sync)
+      - LDAP_MAX_DELETE_PCT=${LDAP_MAX_DELETE_PCT:-25}
+      # Upload-Größenlimit in MB
+      - UPLOAD_MAX_MB=${UPLOAD_MAX_MB:-10}
+      - CORS_ORIGIN=${CORS_ORIGIN:-http://localhost:3900}
       - NODE_ENV=${NODE_ENV:-production}
       - DATABASE_URL=postgresql://${POSTGRES_USER:-workflow}:${POSTGRES_PASSWORD:-workflow}@db:5432/${POSTGRES_DB:-workflow}
       - SESSION_MAX_PER_USER=${SESSION_MAX_PER_USER:-5}