diff --git a/docker-compose.yml b/docker-compose.yml
index f7c61a9..627d1f9 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -81,7 +81,12 @@ services:
     volumes:
       - uploads_data:/data/uploads
     secrets:
-      - box-config
+      # Long-form so the secret lands at `/run/secrets/box-config.json` —
+      # matching BOX_CONFIG_FILE above. The default short-form would mount
+      # at `/run/secrets/box-config` (no extension), causing isBoxConfigured()
+      # to read from the wrong path.
+      - source: box-config
+        target: box-config.json
     depends_on:
       db:
         condition: service_healthy