diff --git a/.env.example b/.env.example
index 9cedb1a..0a30d13 100644
--- a/.env.example
+++ b/.env.example
@@ -16,8 +16,10 @@ GITEA_WEBHOOK_SECRET=
 # Image the agent runs from — built and pushed by .gitea/workflows/build.yml
 GITEA_REGISTRY_IMAGE=gitea.apps.williamturner.eu/<your-gitea-username>/<repo-name>/claude-agent:latest
 
-# --- anthropic ---
-ANTHROPIC_API_KEY=
+# --- claude ---
+# Run `claude setup-token` interactively (needs a browser + Claude Pro/Max subscription)
+# to generate this — it's a long-lived OAuth token, not an API key.
+CLAUDE_CODE_OAUTH_TOKEN=
 
 # --- matrix bot ---
 MATRIX_HOMESERVER_URL=https://matrix.apps.williamturner.eu
diff --git a/docker-compose.yml b/docker-compose.yml
index f54ead5..03405b1 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -47,7 +47,9 @@ services:
       GITEA_URL: ${GITEA_URL}
       GITEA_TOKEN: ${GITEA_TOKEN}
       GITEA_WEBHOOK_SECRET: ${GITEA_WEBHOOK_SECRET}
-      ANTHROPIC_API_KEY: ${ANTHROPIC_API_KEY}
+      # Claude subscription (Pro/Max) auth via `claude setup-token`, not API billing —
+      # Claude Code reads this in preference to ANTHROPIC_API_KEY when both could apply.
+      CLAUDE_CODE_OAUTH_TOKEN: ${CLAUDE_CODE_OAUTH_TOKEN}
       MATRIX_HOMESERVER_URL: ${MATRIX_HOMESERVER_URL}
       MATRIX_BOT_TOKEN: ${MATRIX_BOT_TOKEN}
       MATRIX_CONTROL_ROOM_ID: ${MATRIX_CONTROL_ROOM_ID}