diff --git a/.env.prod.example b/.env.prod.example
index 2ef7b60..2ef674a 100644
--- a/.env.prod.example
+++ b/.env.prod.example
@@ -13,6 +13,8 @@
 # =============================================================================
 DJANGO_ENV=prod
 DJANGO_DEBUG=false
+# Must NOT be empty, must NOT start with django-insecure, must NOT contain "dev-only".
+# If the secret contains $, escape each as $$ (Compose variable expansion).
 DJANGO_SECRET_KEY=replace-with-a-long-random-secret
 DJANGO_ALLOWED_HOSTS=chatbackend.aimloperations.com
 # Optional override; when unset, https:// origins are derived from DJANGO_ALLOWED_HOSTS.
diff --git a/llm_be/llm_be/settings.py b/llm_be/llm_be/settings.py
index 47e0c38..bd2b399 100644
--- a/llm_be/llm_be/settings.py
+++ b/llm_be/llm_be/settings.py
@@ -267,7 +267,17 @@ os.makedirs(directory_path, exist_ok=True)
 ALLOW_IMAGE_GENERATION = env_bool("ALLOW_IMAGE_GENERATION", False)
 ALLOW_INTERNET_ACCESS = env_bool("ALLOW_INTERNET_ACCESS", True)
 
-if DJANGO_ENV in {"prod", "beta"} and (
-    not SECRET_KEY or "dev-only" in SECRET_KEY or SECRET_KEY.startswith("django-insecure")
-):
-    raise ValueError("DJANGO_SECRET_KEY must be set to a real secret in prod/beta.")
+if DJANGO_ENV in {"prod", "beta"}:
+    # Compose treats $ in .env as variable expansion — escape each $ as $$.
+    if not SECRET_KEY:
+        raise ValueError(
+            "DJANGO_SECRET_KEY is empty in prod/beta. Set it in the control-node "
+            "secret (~/Documents/secrets/chat_backend/chat_backend_<env>.env). "
+            "If the value contains $, write $$ or Compose will strip/empty it."
+        )
+    if SECRET_KEY.startswith("django-insecure") or "dev-only" in SECRET_KEY:
+        raise ValueError(
+            "DJANGO_SECRET_KEY still looks like a placeholder "
+            "(starts with 'django-insecure' or contains 'dev-only'). "
+            "Replace it with a real random secret and redeploy."
+        )