diff --git a/docker-compose.yml b/docker-compose.yml
index f639445..740b734 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -32,6 +32,8 @@ secrets:
     file: secrets/igdb_api_client_secret
   hardcover_api_token:
     file: secrets/hardcover_api_token
+  timetracker_secret_key:
+    file: secrets/timetracker_secret_key
 
 configs:
   caddyfile:
@@ -176,12 +178,15 @@ services:
   timetracker:
     image: ${REGISTRY_URL}/timetracker
     container_name: timetracker
+    secrets:
+      - timetracker_secret_key
     environment:
       - TZ=${TZ}
-      - "CSRF_TRUSTED_ORIGINS=https://tracker.kucharczyk.xyz"
+      - "APP_URL=https://tracker.kucharczyk.xyz"
       - PUID=${PUID}
       - PGID=${PGID}
       - DATA_DIR=/home/timetracker/app/data
+      - SECRET_KEY__FILE=/run/secrets/timetracker_secret_key
     volumes:
       - "${DOCKER_STORAGE_PATH}/timetracker/data:/home/timetracker/app/data"
       - "${DOCKER_STORAGE_PATH}/timetracker/backups:/home/timetracker/app/games/fixtures/backups"
diff --git a/secrets/timetracker_secret_key b/secrets/timetracker_secret_key
new file mode 100644
index 0000000..95b7251
Binary files /dev/null and b/secrets/timetracker_secret_key differ