diff --git a/nuxt.config.ts b/nuxt.config.ts
index 57276ef..b9a54ce 100644
--- a/nuxt.config.ts
+++ b/nuxt.config.ts
@@ -27,20 +27,25 @@ export default defineNuxtConfig({
   css: ['~/assets/css/main.css'],
 
   runtimeConfig: {
+    // Private runtime config (server-side only)
+    // These are automatically overridden by NUXT_<KEY> environment variables
+    // Example: NUXT_EMAIL_HOST overrides emailHost
+
     // AUTH_SECRET is now auto-generated and stored in database
-    // Only used if explicitly provided (for advanced users who want manual control)
-    authSecret: process.env.AUTH_SECRET || '',
+    authSecret: '',
     // Admin credentials - auto-generated on first launch if not provided
-    adminUsername: process.env.ADMIN_USERNAME || 'admin',
-    adminPassword: process.env.ADMIN_PASSWORD || '',
-    // Email configuration
-    emailHost: process.env.EMAIL_HOST || 'smtp.example.com',
-    emailPort: process.env.EMAIL_PORT || '587',
-    emailUser: process.env.EMAIL_USER || 'noreply@example.com',
-    emailPassword: process.env.EMAIL_PASSWORD || '',
-    emailFrom: process.env.EMAIL_FROM || 'New Life Christian Church <noreply@example.com>',
+    adminUsername: 'admin',
+    adminPassword: '',
+    // Email configuration - will be overridden by NUXT_EMAIL_* env vars at runtime
+    emailHost: 'smtp.example.com',
+    emailPort: '587',
+    emailUser: 'noreply@example.com',
+    emailPassword: '',
+    emailFrom: 'New Life Christian Church <noreply@example.com>',
     public: {
-      siteUrl: process.env.SITE_URL || 'http://localhost:3000'
+      // Public config accessible to both client and server
+      // Overridden by NUXT_PUBLIC_SITE_URL
+      siteUrl: 'http://localhost:3000'
     }
   }
 })
diff --git a/server/utils/email.ts b/server/utils/email.ts
index bfdb717..9f8e11d 100644
--- a/server/utils/email.ts
+++ b/server/utils/email.ts
@@ -7,30 +7,24 @@ import type { H3Event } from 'h3'
  * In production, environment variables are accessed directly for reliability
  */
 function getEmailConfig(event?: H3Event) {
-  // Try to use runtime config if event is provided
-  if (event) {
-    try {
-      const config = useRuntimeConfig(event)
-      return {
-        emailHost: config.emailHost,
-        emailPort: config.emailPort,
-        emailUser: config.emailUser,
-        emailPassword: config.emailPassword,
-        emailFrom: config.emailFrom,
-      }
-    } catch (e) {
-      console.warn('[EMAIL] Failed to access runtime config, falling back to env vars')
-    }
-  }
-
-  // Fallback to direct environment variable access
-  return {
+  // In production, always use environment variables directly
+  // This ensures Docker runtime env vars are used, not build-time values
+  const config = {
     emailHost: process.env.EMAIL_HOST || 'smtp.example.com',
     emailPort: process.env.EMAIL_PORT || '587',
     emailUser: process.env.EMAIL_USER || 'noreply@example.com',
     emailPassword: process.env.EMAIL_PASSWORD || '',
     emailFrom: process.env.EMAIL_FROM || 'New Life Christian Church <noreply@example.com>',
   }
+
+  // Debug: Log what we're reading from environment
+  console.log('[EMAIL DEBUG] Reading from process.env:')
+  console.log('[EMAIL DEBUG] EMAIL_HOST env var:', process.env.EMAIL_HOST)
+  console.log('[EMAIL DEBUG] EMAIL_PORT env var:', process.env.EMAIL_PORT)
+  console.log('[EMAIL DEBUG] EMAIL_USER env var:', process.env.EMAIL_USER)
+  console.log('[EMAIL DEBUG] EMAIL_FROM env var:', process.env.EMAIL_FROM)
+
+  return config
 }
 
 export async function sendPasswordResetEmail(email: string, code: string, event?: H3Event) {