diff --git a/deploy/.env.prod.template b/deploy/.env.prod.template
index ee97531..078a0ce 100644
--- a/deploy/.env.prod.template
+++ b/deploy/.env.prod.template
@@ -16,14 +16,18 @@
 # REQUIRED: Update with your domain
 APPVIEW_DOMAIN=atcr.io
 
-# Hold service domain (presigned URL generator)
-# REQUIRED: Update with your domain
-HOLD_DOMAIN=hold01.atcr.io
-
 # ==============================================================================
 # Hold Service Configuration
 # ==============================================================================
 
+# Hold service domain (REQUIRED)
+# The hostname where the hold service will be accessible
+# Used by docker-compose.prod.yml to derive:
+#   - HOLD_PUBLIC_URL: https://${HOLD_DOMAIN}
+#   - ATCR_DEFAULT_HOLD_DID: did:web:${HOLD_DOMAIN}
+# Example: hold01.atcr.io
+HOLD_DOMAIN=hold01.atcr.io
+
 # Your ATProto DID (REQUIRED for hold registration)
 # Get your DID from: https://bsky.social/xrpc/com.atproto.identity.resolveHandle?handle=yourhandle.bsky.social
 # Example: did:plc:abc123xyz789
@@ -126,12 +130,9 @@ S3_ENDPOINT=https://6vmss.upcloudobjects.com
 # AppView Configuration
 # ==============================================================================
 
-# Default hold service DID (REQUIRED)
-# This is automatically set by docker-compose.prod.yml to did:web:${HOLD_DOMAIN}
-# Only override this if you want to use a different default hold
-# Format: did:web:hostname[:port]
-# Example: did:web:hold01.atcr.io
-# Note: This is set automatically - no need to configure manually
+# Default hold service DID (derived from HOLD_DOMAIN in docker-compose.prod.yml)
+# Uncomment to override if you want to use a different hold service as the default
+# ATCR_DEFAULT_HOLD_DID=did:web:some-other-hold.example.com
 
 # JWT token expiration in seconds
 # Default: 300 (5 minutes)
diff --git a/deploy/docker-compose.prod.yml b/deploy/docker-compose.prod.yml
index 6129bfd..57be343 100644
--- a/deploy/docker-compose.prod.yml
+++ b/deploy/docker-compose.prod.yml
@@ -50,8 +50,8 @@ services:
       ATCR_BASE_URL: https://${APPVIEW_DOMAIN:-atcr.io}
       ATCR_SERVICE_NAME: ${APPVIEW_DOMAIN:-atcr.io}
 
-      # Storage configuration
-      ATCR_DEFAULT_HOLD_DID: did:web:${HOLD_DOMAIN:-hold01.atcr.io}
+      # Storage configuration (derived from HOLD_DOMAIN)
+      ATCR_DEFAULT_HOLD_DID: ${ATCR_DEFAULT_HOLD_DID:-did:web:${HOLD_DOMAIN:-hold01.atcr.io}}
 
       # Authentication
       ATCR_AUTH_KEY_PATH: /var/lib/atcr/auth/private-key.pem
@@ -91,8 +91,8 @@ services:
     container_name: atcr-hold
     restart: unless-stopped
     environment:
-      # Hold service configuration
-      HOLD_PUBLIC_URL: https://${HOLD_DOMAIN:-hold01.atcr.io}
+      # Hold service configuration (derived from HOLD_DOMAIN)
+      HOLD_PUBLIC_URL: ${HOLD_PUBLIC_URL:-https://${HOLD_DOMAIN:-hold01.atcr.io}}
       HOLD_SERVER_ADDR: :8080
       HOLD_ALLOW_ALL_CREW: ${HOLD_ALLOW_ALL_CREW:-false}
       HOLD_PUBLIC: ${HOLD_PUBLIC:-false}