diff --git a/.env.example b/.env.hold.example
similarity index 100%
rename from .env.example
rename to .env.hold.example
diff --git a/Dockerfile.hold b/Dockerfile.hold
index f5791aa..383fe21 100644
--- a/Dockerfile.hold
+++ b/Dockerfile.hold
@@ -23,9 +23,6 @@ WORKDIR /root/
 # Copy binary from builder
 COPY --from=builder /app/atcr-hold .
 
-# Copy default config
-COPY config/hold.yml /etc/atcr/hold.yml
-
 # Create directories for storage
 RUN mkdir -p /var/lib/atcr/hold
 
diff --git a/config/hold.yml b/config/hold.yml
deleted file mode 100644
index 73056c6..0000000
--- a/config/hold.yml
+++ /dev/null
@@ -1,16 +0,0 @@
-# DEPRECATED: This config file is no longer used
-#
-# The hold service now loads all configuration from environment variables.
-# Please use .env.example as a reference and set environment variables instead.
-#
-# See .env.example for all available configuration options.
-#
-# Key changes:
-# - Storage config now uses standard env vars (AWS_ACCESS_KEY_ID, etc.)
-# - Authorization is now based on PDS records (hold.public, crew records)
-# - No more allow_all or allowed_dids config
-#
-# To run the hold service:
-#   1. Copy .env.example to .env
-#   2. Fill in your values
-#   3. Run: source .env && ./atcr-hold
diff --git a/docker-compose.yml b/docker-compose.yml
index 9b46cc8..24b3f07 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -29,13 +29,16 @@ services:
     # Future: Add read_only: true for production deployments
 
   atcr-hold:
+    env_file:
+      - ../atcr-secrets.env  # Load S3/Storj credentials from external file
     environment:
       HOLD_PUBLIC_URL: http://172.28.0.3:8080
       HOLD_OWNER: did:plc:pddp4xt5lgnv2qsegbzzs4xg
       HOLD_PUBLIC: false
-      STORAGE_DRIVER: filesystem
-      STORAGE_ROOT_DIR: /var/lib/atcr/hold
+      # STORAGE_DRIVER: filesystem
+      # STORAGE_ROOT_DIR: /var/lib/atcr/hold
       TEST_MODE: true
+      # Storage config comes from env_file (STORAGE_DRIVER, AWS_*, S3_*)
     build:
       context: .
       dockerfile: Dockerfile.hold