diff --git a/docker-compose.yml b/docker-compose.yml
index 81b30e6..01c51a2 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -82,6 +82,11 @@ services:
       # this URL and keep DATABASE_URL (the owner) for migrations/schema init.
       - APP_DATABASE_URL=postgresql://receipt_app:${APP_DATABASE_PASSWORD:-receipt_app_secure_password}@postgres:5432/${POSTGRES_DB:-receipt_scanner}
       - NEXT_PUBLIC_APP_URL=${NEXT_PUBLIC_APP_URL:-http://localhost:3000}
+      # Scopes session/CSRF/guest/OAuth cookies to the parent domain so
+      # app.<domain> and admin.<domain> share the same login as the bare
+      # domain (see src/lib/auth/config.ts). Leave unset for host-only
+      # cookies (single-domain / local development).
+      - COOKIE_DOMAIN=${COOKIE_DOMAIN:-}
       - NEXT_PUBLIC_UMAMI_SRC=${NEXT_PUBLIC_UMAMI_SRC:-}
       - NEXT_PUBLIC_UMAMI_ID=${NEXT_PUBLIC_UMAMI_ID:-}
       - OPENROUTER_API_KEY=${OPENROUTER_API_KEY}