diff --git a/.env b/.env
new file mode 100644
index 0000000..c12d187
--- /dev/null
+++ b/.env
@@ -0,0 +1 @@
+PGPASSWORD=postgres
diff --git a/README.md b/README.md
index 0464fa5..4a7fc2a 100644
--- a/README.md
+++ b/README.md
@@ -2,6 +2,7 @@
 A datbase for Hydroshare based on official images.
 
 1. Open port 5432 on the host's firewall to the subnets making connections.
+1. Set `PGPASSWORD` in `.env`.
 1. `docker-compose up -d`
 1. Place a SQL dump to load into the database in /var/scratch/pg.deploy.sql on the host.
 1. `./loaddb.sh`
diff --git a/docker-compose.yml b/docker-compose.yml
index dc5ec5f..de8111c 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -4,7 +4,7 @@ services:
   postgis:
     image: postgis/postgis:15-3.3
     environment:
-      POSTGRES_PASSWORD: 'postgres'
+      POSTGRES_PASSWORD: ${PGPASSWORD?PGPASSWORD is unset}
     container_name: postgis
     restart: unless-stopped
     volumes: