diff --git a/server/community-store.ts b/server/community-store.ts
index 2163b0d..8633dd9 100644
--- a/server/community-store.ts
+++ b/server/community-store.ts
@@ -904,7 +904,10 @@ export function setEncryption(
  * For now, uses a deterministic HMAC-based key from a server secret.
  */
 async function deriveSpaceKey(keyId: string): Promise<CryptoKey> {
-	const serverSecret = process.env.ENCRYPTION_SECRET || 'REDACTED_ENCRYPTION_FALLBACK';
+	const serverSecret = process.env.ENCRYPTION_SECRET;
+	if (!serverSecret) {
+		throw new Error('ENCRYPTION_SECRET environment variable is required');
+	}
 	const encoder = new TextEncoder();
 	const keyMaterial = await crypto.subtle.importKey(
 		'raw',
diff --git a/server/local-first/migration/dry-run.ts b/server/local-first/migration/dry-run.ts
index 73d6cc5..d0981c5 100644
--- a/server/local-first/migration/dry-run.ts
+++ b/server/local-first/migration/dry-run.ts
@@ -20,8 +20,10 @@ import {
   type MigrationResult,
 } from './pg-to-automerge';
 
-const DATABASE_URL =
-  process.env.DATABASE_URL || 'postgres://rspace:REDACTED@rspace-db:5432/rspace';
+const DATABASE_URL = process.env.DATABASE_URL;
+if (!DATABASE_URL) {
+  throw new Error('DATABASE_URL environment variable is required');
+}
 
 const sql = postgres(DATABASE_URL, { max: 5, idle_timeout: 10 });
 
diff --git a/server/local-first/migration/run-migration.ts b/server/local-first/migration/run-migration.ts
index c6d74ad..da8dddd 100644
--- a/server/local-first/migration/run-migration.ts
+++ b/server/local-first/migration/run-migration.ts
@@ -19,8 +19,10 @@ import {
 import { syncServer } from '../../sync-instance';
 import { loadAllDocs, docIdToPath } from '../doc-persistence';
 
-const DATABASE_URL =
-  process.env.DATABASE_URL || 'postgres://rspace:REDACTED@rspace-db:5432/rspace';
+const DATABASE_URL = process.env.DATABASE_URL;
+if (!DATABASE_URL) {
+  throw new Error('DATABASE_URL environment variable is required');
+}
 
 const sql = postgres(DATABASE_URL, { max: 5, idle_timeout: 10 });
 
diff --git a/shared/db/pool.ts b/shared/db/pool.ts
index b9d32c0..88fb159 100644
--- a/shared/db/pool.ts
+++ b/shared/db/pool.ts
@@ -7,8 +7,10 @@
 
 import postgres from "postgres";
 
-const DATABASE_URL =
-	process.env.DATABASE_URL || "postgres://rspace:REDACTED@rspace-db:5432/rspace";
+const DATABASE_URL = process.env.DATABASE_URL;
+if (!DATABASE_URL) {
+	throw new Error("DATABASE_URL environment variable is required");
+}
 
 /** Global shared connection */
 export const sql = postgres(DATABASE_URL, {