diff --git a/docker-compose.microservices.dokploy.yml b/docker-compose.microservices.dokploy.yml
index d54741d..ad04c11 100644
--- a/docker-compose.microservices.dokploy.yml
+++ b/docker-compose.microservices.dokploy.yml
@@ -2,7 +2,7 @@ x-dorknet-service-env: &dorknet-service-env
   DORKNET_DOMAIN: ${DORKNET_DOMAIN:?Set DORKNET_DOMAIN in Dokploy}
   DORKNET_JWT_SECRET: ${DORKNET_JWT_SECRET:?Set DORKNET_JWT_SECRET in Dokploy}
   Database__Provider: postgres
-  ConnectionStrings__Default: Host=postgres;Port=5432;Database=dorknet;Username=dorknet;Password=${POSTGRES_PASSWORD:?Set POSTGRES_PASSWORD in Dokploy}
+  ConnectionStrings__Default: ${DORKNET_POSTGRES_CONNECTION_STRING:-Host=postgres;Port=5432;Database=dorknet;Username=dorknet;Password=${POSTGRES_PASSWORD:-dorknet_dev}}
   ConnectionStrings__Redis: redis:6379
   S3__Endpoint: ${DORKNET_S3_ENDPOINT:?Set DORKNET_S3_ENDPOINT in Dokploy}
   S3__AccessKey: ${DORKNET_S3_ACCESS_KEY:?Set DORKNET_S3_ACCESS_KEY in Dokploy}
@@ -182,7 +182,7 @@ services:
     environment:
       POSTGRES_DB: dorknet
       POSTGRES_USER: dorknet
-      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:?Set POSTGRES_PASSWORD in Dokploy}
+      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:-dorknet_dev}
     volumes:
       - microservices-postgres:/var/lib/postgresql/data
 
diff --git a/docker-compose.microservices.yml b/docker-compose.microservices.yml
index 220e076..15449b1 100644
--- a/docker-compose.microservices.yml
+++ b/docker-compose.microservices.yml
@@ -2,7 +2,7 @@ x-dorknet-service-env: &dorknet-service-env
   DORKNET_DOMAIN: ${DORKNET_DOMAIN:-localhost}
   DORKNET_JWT_SECRET: ${DORKNET_JWT_SECRET:-dorknet-dev-jwt-secret-000000000000000000000000000000000000000000}
   Database__Provider: postgres
-  ConnectionStrings__Default: Host=postgres;Port=5432;Database=dorknet;Username=dorknet;Password=${POSTGRES_PASSWORD:-dorknet_dev}
+  ConnectionStrings__Default: ${DORKNET_POSTGRES_CONNECTION_STRING:-Host=postgres;Port=5432;Database=dorknet;Username=dorknet;Password=${POSTGRES_PASSWORD:-dorknet_dev}}
   ConnectionStrings__Redis: redis:6379
   S3__Endpoint: ${DORKNET_S3_ENDPOINT:-}
   S3__AccessKey: ${DORKNET_S3_ACCESS_KEY:-}
diff --git a/docs/deploy.md b/docs/deploy.md
index f007725..7c1c96d 100644
--- a/docs/deploy.md
+++ b/docs/deploy.md
@@ -165,6 +165,33 @@ POSTGRES_PASSWORD=replace-with-a-random-db-password
 CLOUDFLARE_TUNNEL_TOKEN=<token from Cloudflare Zero Trust tunnel>
 ```
 
+By default the service containers connect to the bundled compose
+Postgres service:
+
+```env
+Host=postgres;Port=5432;Database=dorknet;Username=dorknet;Password=${POSTGRES_PASSWORD}
+```
+
+To use a Dokploy-managed or external Postgres instead, set a full
+connection string and the compose services will use it instead of the
+bundled `postgres` hostname:
+
+```env
+DORKNET_POSTGRES_CONNECTION_STRING=Host=<postgres-host>;Port=5432;Database=dorknet;Username=<user>;Password=<password>
+```
+
+For hosted Postgres that requires TLS, include the Npgsql SSL options:
+
+```env
+DORKNET_POSTGRES_CONNECTION_STRING=Host=<postgres-host>;Port=5432;Database=dorknet;Username=<user>;Password=<password>;SSL Mode=Require;Trust Server Certificate=true
+```
+
+If you use the bundled compose Postgres, `POSTGRES_PASSWORD` must match
+the password that initialized the existing Postgres volume. Changing
+`POSTGRES_PASSWORD` later does not change the already-created `dorknet`
+database user; either restore the original password, reset it inside
+Postgres, or recreate the Postgres volume.
+
 In Cloudflare Zero Trust, configure the tunnel with two public hostnames:
 
 ```text