diff --git a/config/.env.template b/config/.env.template
index b604c10..4850222 100644
--- a/config/.env.template
+++ b/config/.env.template
@@ -1,25 +1,22 @@
-# AI Data Analyst - Environment Variables
-# ========================================
-# Secret values referenced by ${VAR} in config/instance.yaml.
+# Agnes AI Data Analyst - Environment Variables
 # Copy to .env: cp config/.env.template .env
 # .env is gitignored - NEVER commit it.
 
-# Required for webapp
-WEBAPP_SECRET_KEY=           # python -c "import secrets; print(secrets.token_hex(32))"
-GOOGLE_CLIENT_ID=
-GOOGLE_CLIENT_SECRET=
+# Required
+JWT_SECRET_KEY=           # python -c "import secrets; print(secrets.token_hex(32))"
 
-# Keboola adapter (skip if using CSV)
+# Google OAuth (optional — needed for Google login)
+# GOOGLE_CLIENT_ID=
+# GOOGLE_CLIENT_SECRET=
+
+# Keboola adapter (optional — skip if using CSV/sample data)
 # KEBOOLA_STORAGE_TOKEN=
+# KEBOOLA_STACK_URL=https://connection.keboola.com
 
-# Optional
-# SENDGRID_API_KEY=
+# Bootstrap admin (optional — used on first docker compose up)
+# SEED_ADMIN_EMAIL=admin@example.com
+
+# Optional services
 # TELEGRAM_BOT_TOKEN=
-# DESKTOP_JWT_SECRET=
-# JIRA_API_TOKEN=
 # JIRA_WEBHOOK_SECRET=
-# JIRA_SLA_API_TOKEN=
 # ANTHROPIC_API_KEY=
-# LLM API key for proxy routing (referenced as ${LLM_API_KEY} in instance.yaml)
-# Provider and model configured in instance.yaml ai: section
-# LLM_API_KEY=