diff --git a/.env.example b/.env.example
new file mode 100644
index 0000000..bc59906
--- /dev/null
+++ b/.env.example
@@ -0,0 +1,12 @@
+# Email configuration for SMTP-based password reset mail delivery
+# Copy this file to .env and fill in the actual values (especially EMAIL_PASSWORD_RESET_PASSWORD)
+# The .env file is loaded automatically by docker compose and is git-ignored to keep credentials safe
+
+EMAIL_PROVIDER=Smtp
+EMAIL_SMTP_HOST=smtps.udag.de
+EMAIL_SMTP_PORT=587
+EMAIL_PASSWORD_RESET_USERNAME=passwort@omsorg-pflegedienste.de
+EMAIL_PASSWORD_RESET_PASSWORD=
+EMAIL_PASSWORD_RESET_SENDER=passwort@omsorg-pflegedienste.de
+EMAIL_PASSWORD_RESET_SUBJECT=Ihr OMSORG Passwort-Reset-Code
+EMAIL_PASSWORD_RESET_BODY_TEMPLATE=Ihr Code lautet: $$RESET_PIN$$\nDer Code ist $$RESET_PIN_EXPIRY_MINUTES$$ Minuten gültig.
diff --git a/.gitignore b/.gitignore
index 89ac81e..30a67e9 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1,4 +1,5 @@
 # Config with credentials
+.env
 **/mitarbeiter-app*/lib/config.php
 **/mitarbeiter-app*/lib/config.secret.php
 
diff --git a/docker-compose.yml b/docker-compose.yml
index dc39200..268f6b7 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -75,6 +75,14 @@ services:
       ConnectionStrings__OmsorgCore: "Host=postgres;Port=5432;Database=omsorg_core;Username=omsorg_core;Password=omsorg_core_dev_password"
       Jwt__Secret: "CHANGE_ME_LOCAL_DEV_SECRET_MIN_32_CHARS_LONG"
       Cors__AllowedOrigins__0: "https://app.omsorg-pflegedienste.de"
+      Email__Provider: "${EMAIL_PROVIDER}"
+      Email__Smtp__Host: "${EMAIL_SMTP_HOST}"
+      Email__Smtp__Port: "${EMAIL_SMTP_PORT}"
+      Email__Accounts__PasswordReset__Username: "${EMAIL_PASSWORD_RESET_USERNAME}"
+      Email__Accounts__PasswordReset__Password: "${EMAIL_PASSWORD_RESET_PASSWORD}"
+      Email__Accounts__PasswordReset__SenderAddress: "${EMAIL_PASSWORD_RESET_SENDER}"
+      Email__PasswordResetTemplate__Subject: "${EMAIL_PASSWORD_RESET_SUBJECT}"
+      Email__PasswordResetTemplate__BodyTemplate: "${EMAIL_PASSWORD_RESET_BODY_TEMPLATE}"
     ports:
       # Nur auf dem Host erreichbar (für den Reverse-Proxy oben), nie auf der öffentlichen
       # Schnittstelle - matcht das 127.0.0.1:5173-Muster im bestehenden Host-nginx.