diff --git a/docker-compose.yml b/docker-compose.yml
index 173917e..0ac1d3f 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -211,21 +211,10 @@ services:
     network_mode: host
     security_opt:
       - no-new-privileges:true
+    # Generated by: ./scripts/render-cloudflare-ddns-env.sh  (from secrets/.env)
+    # Path is relative to the compose project dir (/opt/stack).
     env_file:
-      - path: ${CONFIG_DIR}/cloudflare-ddns/ddns.env
-        required: false
-    environment:
-      TZ: ${TZ}
-      # Fallbacks if ddns.env not rendered yet (prefer secrets via render script)
-      CLOUDFLARE_API_TOKEN: ${CLOUDFLARE_API_TOKEN:-${CLOUDFLAREAPIKEY:-}}
-      IP4_DOMAINS: ${CLOUDFLARE_IP4_DOMAINS:-}
-      IP4_PROVIDER: ${CLOUDFLARE_IP4_PROVIDER:-cloudflare.trace}
-      IP6_PROVIDER: none
-      PROXIED: ${CLOUDFLARE_PROXIED:-false}
-      UPDATE_CRON: ${CLOUDFLARE_UPDATE_CRON:-@every 5m}
-      UPDATE_ON_START: "true"
-      TTL: "1"
-      RECORD_COMMENT: arr-stack cloudflare-ddns
+      - ./config/cloudflare-ddns/ddns.env
 
   # ------------------------------------------------------------------- music #
   lidarr: