diff --git a/.env.docker.example b/.env.docker.example
index e9ef34c..1facb56 100644
--- a/.env.docker.example
+++ b/.env.docker.example
@@ -55,3 +55,9 @@ BCRYPT_ROUNDS=12
 # --- Admin user (seeded on first start) --------------------------------------
 ADMIN_EMAIL=admin@example.com
 ADMIN_PASSWORD=Admin123!
+
+# --- MAIL_ENCRYPTION_KEY (REQUIRED) -------------------------------------------
+# AES-256 encryption key for mail account passwords (Fernet).
+# Generate with:
+#   python -c "import secrets; print(secrets.token_urlsafe(32))"
+MAIL_ENCRYPTION_KEY=GENERATE_STRONG_KEY_HERE
diff --git a/docker-compose.yaml b/docker-compose.yaml
index 38529f8..ccacb8a 100644
--- a/docker-compose.yaml
+++ b/docker-compose.yaml
@@ -93,6 +93,7 @@ services:
       BCRYPT_ROUNDS: ${BCRYPT_ROUNDS:-12}
       ADMIN_EMAIL: ${ADMIN_EMAIL:-admin@media-on.de}
       ADMIN_PASSWORD: ${ADMIN_PASSWORD:-Admin123!}
+      MAIL_ENCRYPTION_KEY: ${MAIL_ENCRYPTION_KEY:?MAIL_ENCRYPTION_KEY is required}
     volumes:
       - storage:/data/storage
     mem_limit: 512m
@@ -134,6 +135,7 @@ services:
       SMTP_PASSWORD: ${SMTP_PASSWORD:-}
       SMTP_FROM: ${SMTP_FROM:-no-reply@localhost}
       SMTP_TLS: ${SMTP_TLS:-true}
+      MAIL_ENCRYPTION_KEY: ${MAIL_ENCRYPTION_KEY:?MAIL_ENCRYPTION_KEY is required}
     volumes:
       - storage:/data/storage
     mem_limit: 256m
diff --git a/docs/deploy-guide.md b/docs/deploy-guide.md
index 6400e27..4953b74 100644
--- a/docs/deploy-guide.md
+++ b/docs/deploy-guide.md
@@ -43,6 +43,7 @@ bash /a0/usr/projects/leocrm/scripts/fast-deploy.sh full
 - Produktions-DB: postgresql+asyncpg://crm_user:86FkF5vJ_qKYgO6Myj0eQ4Dtm3Dyb1ge@postgres:5432/crm_db
 - Redis: redis://default:6VJ7pp8afXXZMnx0JztWFk-OYCLwJfX4@redis:6379/0
 - SECRET_KEY: DoYnyh_UnvnYphX-qryiaIpQhm8JB39m_xkat9cNmrGpyKSSZvW9jF1tusIUSP5g
+- MAIL_ENCRYPTION_KEY: test-mail-encryption-key (AES-256 Fernet Key für Mail-Passwort-Verschlüsselung, in Coolify als Environment Variable setzen)
 
 ## Coolify Resources
 - Project UUID: mzu7fvhtad82ujgmbsmyvxzm