diff --git a/.env.example b/.env.example
index bc171bd..ce9df51 100644
--- a/.env.example
+++ b/.env.example
@@ -16,10 +16,10 @@ POSTGRES_PASSWORD=change-me-in-local-dev
 REDIS_PASSWORD=change-me-in-local-dev
 
 # --- Shared secrets (local dev values — never reuse in production) ---
-JWT_SECRET=local-dev-jwt-secret-change-me
+JWT_SECRET=local-dev-jwt-secret-change-me-at-least-32-chars
 # Encrypts DKIM private keys and provider tokens at rest. Losing it makes every
 # stored secret unrecoverable — back it up separately from the database.
-LAMBDAMAIL_MASTER_KEY=local-dev-master-key-32-bytes-min
+LAMBDAMAIL_MASTER_KEY=local-dev-master-key-32-bytes-minimum-value
 
 # --- Host identity ---
 PRIMARY_MAIL_HOST=mail.localhost