diff --git a/docker-compose.yml b/docker-compose.yml
index 4c3bd30..8523ea6 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -71,11 +71,15 @@ services:
       STRIPE_PRICE_ID_PRO_YEARLY: ${STRIPE_PRICE_ID_PRO_YEARLY:-}
       STRIPE_PRICE_ID_BUSINESS_MONTHLY: ${STRIPE_PRICE_ID_BUSINESS_MONTHLY:-}
       STRIPE_PRICE_ID_BUSINESS_YEARLY: ${STRIPE_PRICE_ID_BUSINESS_YEARLY:-}
-      # Email & Analytics
-      RESEND_API_KEY: ${RESEND_API_KEY:-}
-      NEXT_PUBLIC_POSTHOG_KEY: ${NEXT_PUBLIC_POSTHOG_KEY:-}
-      NEXT_PUBLIC_POSTHOG_HOST: ${NEXT_PUBLIC_POSTHOG_HOST:-https://us.i.posthog.com}
-      # Cloudflare R2 Storage
+      # Email & Analytics
+      RESEND_API_KEY: ${RESEND_API_KEY:-}
+      SMTP_HOST: ${SMTP_HOST:-smtp.qrmaster.net}
+      SMTP_PORT: ${SMTP_PORT:-465}
+      SMTP_USER: ${SMTP_USER:-timo@qrmaster.net}
+      SMTP_PASS: ${SMTP_PASS:-}
+      NEXT_PUBLIC_POSTHOG_KEY: ${NEXT_PUBLIC_POSTHOG_KEY:-}
+      NEXT_PUBLIC_POSTHOG_HOST: ${NEXT_PUBLIC_POSTHOG_HOST:-https://us.i.posthog.com}
+      # Cloudflare R2 Storage
       R2_ACCOUNT_ID: ${R2_ACCOUNT_ID:-}
       R2_ACCESS_KEY_ID: ${R2_ACCESS_KEY_ID:-}
       R2_SECRET_ACCESS_KEY: ${R2_SECRET_ACCESS_KEY:-}
diff --git a/src/lib/email.ts b/src/lib/email.ts
index a7541c5..d0ac59e 100644
--- a/src/lib/email.ts
+++ b/src/lib/email.ts
@@ -538,17 +538,26 @@ export async function sendAIFeatureLaunchEmail(email: string) {
 // SMTP Transport (nodemailer) — used for retention / welcome emails
 // ---------------------------------------------------------------------------
 
-function createSmtpTransport() {
-  return nodemailer.createTransport({
-    host: process.env.SMTP_HOST || 'smtp.qrmaster.net',
-    port: parseInt(process.env.SMTP_PORT || '465', 10),
-    secure: true, // port 465 = SSL
-    auth: {
-      user: process.env.SMTP_USER || 'timo@qrmaster.net',
-      pass: process.env.SMTP_PASS,
-    },
-  });
-}
+function createSmtpTransport() {
+  const host = process.env.SMTP_HOST || 'smtp.qrmaster.net';
+  const port = parseInt(process.env.SMTP_PORT || '465', 10);
+  const user = process.env.SMTP_USER || 'timo@qrmaster.net';
+  const pass = process.env.SMTP_PASS?.trim();
+
+  if (!pass) {
+    throw new Error('SMTP_PASS is missing. Configure SMTP credentials before sending welcome or retention emails.');
+  }
+
+  return nodemailer.createTransport({
+    host,
+    port,
+    secure: port === 465,
+    auth: {
+      user,
+      pass,
+    },
+  });
+}
 
 const appUrl = process.env.NEXT_PUBLIC_APP_URL || 'https://www.qrmaster.net';