diff --git a/docker-compose.yml b/docker-compose.yml
index fd012f5..74c04bd 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -20,13 +20,11 @@ services:
     env_file:
       - /opt/camtalk/.env
     environment:
-      # 三级存储配置
+      # 三级存储配置（敏感信息通过 env_file 注入）
       - CAMTALK_STORAGE_REDIS_ENABLED=${CAMTALK_STORAGE_REDIS_ENABLED:-true}
       - CAMTALK_STORAGE_PERSISTENCE_ENABLED=${CAMTALK_STORAGE_PERSISTENCE_ENABLED:-true}
       - CAMTALK_STORAGE_PERSISTENCE_DRIVER=${CAMTALK_STORAGE_PERSISTENCE_DRIVER:-postgres}
-      - CAMTALK_STORAGE_DSN=postgres://${POSTGRES_USER}:${POSTGRES_PASSWORD}@postgres:5432/camtalk?sslmode=disable
       - CAMTALK_REDIS_ADDR=redis:6379
-      - CAMTALK_REDIS_PASSWORD=${CAMTALK_REDIS_PASSWORD:-}
     depends_on:
       postgres:
         condition: service_healthy
@@ -39,9 +37,9 @@ services:
   postgres:
     image: docker.m.daocloud.io/library/postgres:15-alpine
     container_name: camtalk-postgres
+    env_file:
+      - /opt/camtalk/.env
     environment:
-      POSTGRES_USER: ${POSTGRES_USER}
-      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD}
       POSTGRES_DB: camtalk
     volumes:
       - pgdata:/var/lib/postgresql/data
@@ -49,7 +47,7 @@ services:
     networks:
       - camtalk-net
     healthcheck:
-      test: ["CMD-SHELL", "pg_isready -U ${POSTGRES_USER} -d camtalk"]
+      test: ["CMD-SHELL", "pg_isready -U $$POSTGRES_USER -d camtalk"]
       interval: 5s
       timeout: 3s
       retries: 10
@@ -58,6 +56,8 @@ services:
   redis:
     image: docker.m.daocloud.io/library/redis:7-alpine
     container_name: camtalk-redis
+    env_file:
+      - /opt/camtalk/.env
     command: >
       sh -c '
       if [ -n "$$CAMTALK_REDIS_PASSWORD" ]; then
@@ -65,8 +65,6 @@ services:
       else
         exec redis-server --appendonly yes
       fi'
-    environment:
-      CAMTALK_REDIS_PASSWORD: ${CAMTALK_REDIS_PASSWORD:-}
     volumes:
       - redisdata:/data
     networks: