diff --git a/README.md b/README.md
index a06c015..ea77156 100644
--- a/README.md
+++ b/README.md
@@ -20,6 +20,7 @@ Authorizer v2 requires the following variables. Configure them in Render's envir
 | -------- | ----------- | ------- |
 | `DATABASE_TYPE` | Database type | `postgres` |
 | `DATABASE_URL` | Database connection string | *(auto-configured by Render)* |
+| `AUTHORIZER_URL` | This deployment's own public base URL **(required)**. Not the same as allowed origins — this is where Authorizer itself lives. The server exits at boot without it | `https://your-app.onrender.com` |
 | `JWT_TYPE` | JWT signing algorithm | `HS256` |
 | `JWT_SECRET` | JWT signing secret | `test` |
 | `ENCRYPTION_KEY` | At-rest key for TOTP secrets and OTP digests. Required with `RS*`/`ES*` | *(output of `openssl rand -hex 32`)* |
diff --git a/render.yaml b/render.yaml
index 870f347..c9e9d98 100644
--- a/render.yaml
+++ b/render.yaml
@@ -39,12 +39,20 @@ services:
         # it is a new internet-facing authenticated surface.
         value: "false"
       - key: AUTHORIZER_URL
-        # Canonical/trusted base URL of this deployment (e.g. your Render
-        # service URL). When set, it is the only source used to build
+        # REQUIRED — the server exits at boot without it, so the service will
+        # fail to start until this is set. Render prompts for it at blueprint
+        # deploy; if you skip the prompt, set it in the dashboard as soon as
+        # the service URL is known and redeploy.
+        #
+        # Canonical/trusted base URL of this deployment — your Render service
+        # URL, e.g. https://authorizer.onrender.com (include the scheme; a
+        # bare hostname is rejected). It is the only source used to build
         # verification/reset/magic-link URLs, the JWT iss claim, and OIDC
-        # discovery URLs. Leaving it empty exposes host-header-injection
-        # account takeover (CWE-640) — set this in the Render dashboard
-        # once the service URL is known.
+        # discovery URLs; deriving them from request headers instead exposes
+        # host-header-injection account takeover (CWE-640).
+        #
+        # Not populated automatically: a blueprint cannot concatenate the
+        # scheme onto fromService.host, and the value must be a full URL.
         sync: false
       # ----------------------------------------------------------------
       # April 2026 security hardening flags. See