diff --git a/docker/Dockerfile b/docker/Dockerfile
index eccf44c4..30e2e981 100644
--- a/docker/Dockerfile
+++ b/docker/Dockerfile
@@ -273,7 +273,10 @@ ENV PORT=1349 \
     SESSION_DURATION_HOURS=168 \
     LOGIN_ATTEMPT_LIMIT=500 \
     LOG_LEVEL=info \
-    TRUST_PROXY=true
+    TRUST_PROXY=true \
+    OIDC_ENABLED=false \
+    EXTERNAL_URL= \
+    COOKIE_SECRET=
 
 # NVIDIA Container Toolkit env vars (harmless on non-GPU systems)
 ENV NVIDIA_VISIBLE_DEVICES=all \
diff --git a/docker/docker-compose-gpu.yml b/docker/docker-compose-gpu.yml
index d3f179e9..da4d25ec 100644
--- a/docker/docker-compose-gpu.yml
+++ b/docker/docker-compose-gpu.yml
@@ -33,6 +33,20 @@ services:
       - MAX_USERS=${MAX_USERS:-0}
       - SESSION_DURATION_HOURS=${SESSION_DURATION_HOURS:-168}
       - TRUST_PROXY=${TRUST_PROXY:-true}
+      # OIDC Authentication (optional)
+      # - EXTERNAL_URL=https://photos.example.com
+      # - OIDC_ENABLED=false
+      # - OIDC_ISSUER_URL=
+      # - OIDC_CLIENT_ID=
+      # - OIDC_CLIENT_SECRET=
+      # - OIDC_SCOPES=openid profile email
+      # - OIDC_AUTO_CREATE_USERS=true
+      # - OIDC_DEFAULT_ROLE=user
+      # - OIDC_AUTO_LINK_USERS=false
+      # - OIDC_PROVIDER_NAME=
+      # - OIDC_USERNAME_CLAIM=preferred_username
+      # - OIDC_CLOCK_TOLERANCE=30
+      # - COOKIE_SECRET=
     restart: unless-stopped
     healthcheck:
       test: ["CMD", "curl", "-f", "http://localhost:1349/api/v1/health"]
diff --git a/docker/docker-compose.yml b/docker/docker-compose.yml
index 8e8ce2da..858ed691 100644
--- a/docker/docker-compose.yml
+++ b/docker/docker-compose.yml
@@ -32,6 +32,20 @@ services:
       - MAX_USERS=${MAX_USERS:-0}
       - SESSION_DURATION_HOURS=${SESSION_DURATION_HOURS:-168}
       - TRUST_PROXY=${TRUST_PROXY:-true}
+      # OIDC Authentication (optional)
+      # - EXTERNAL_URL=https://photos.example.com
+      # - OIDC_ENABLED=false
+      # - OIDC_ISSUER_URL=
+      # - OIDC_CLIENT_ID=
+      # - OIDC_CLIENT_SECRET=
+      # - OIDC_SCOPES=openid profile email
+      # - OIDC_AUTO_CREATE_USERS=true
+      # - OIDC_DEFAULT_ROLE=user
+      # - OIDC_AUTO_LINK_USERS=false
+      # - OIDC_PROVIDER_NAME=
+      # - OIDC_USERNAME_CLAIM=preferred_username
+      # - OIDC_CLOCK_TOLERANCE=30
+      # - COOKIE_SECRET=
     restart: unless-stopped
     healthcheck:
       test: ["CMD", "curl", "-f", "http://localhost:1349/api/v1/health"]