diff --git a/docker-compose.yml b/docker-compose.yml
index ba20419..1a518f5 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -834,8 +834,7 @@ services:
       - PGID=$PGID
       - TZ=$TZ
       - KOMETA_TIMES=01:00
-      - PLEX_TOKEN=$PLEX_TOKEN
-      - TMDB_API_READ_ACCESS_TOKEN=$TMDB_API_READ_ACCESS_TOKEN
+      - KOMETA_PLEX_TOKEN=$PLEX_TOKEN
     logging: *default-logging
     labels:
       - "traefik.enable=true"
diff --git a/env.example b/env.example
index 8bb058e..a3a12a1 100755
--- a/env.example
+++ b/env.example
@@ -19,4 +19,5 @@ CLOUDFLARE_ZONEID=
 PIHOLE_PWD=
 
 PLEX_TOKEN=
+TMDB_API_KEY=
 TMDB_API_READ_ACCESS_TOKEN=
diff --git a/kometa/config.yml.example b/kometa/config.yml.example
index 35a5287..f3dc131 100644
--- a/kometa/config.yml.example
+++ b/kometa/config.yml.example
@@ -4,10 +4,10 @@
 
 plex:
   url: http://plex:32400
-  token: <<env(PLEX_TOKEN)>>
+  token: env  # reads from KOMETA_PLEX_TOKEN env var (set in docker-compose)
 
 tmdb:
-  apikey: <<env(TMDB_API_READ_ACCESS_TOKEN)>>
+  apikey: YOUR_TMDB_READ_ACCESS_TOKEN_HERE  # paste token directly; this file is not tracked in git
   language: en
   region: US