diff --git a/docker-compose.arena.yml b/docker-compose.arena.yml
index 42d9d93..9a1c06b 100644
--- a/docker-compose.arena.yml
+++ b/docker-compose.arena.yml
@@ -52,10 +52,19 @@ services:
       # Deliberately OMITTED: this instance IS the upstream — never point it at
       # another arena.
       # - ARENA_UPSTREAM_URL=
-      # ── Payments are OUT OF SCOPE for this deployment (phase 09 CONTEXT.md
-      #    scope fence: "OUT: Lightning/cashu payment changes"). Do not set:
-      # - BOTFIGHTS_WALLET_ENCRYPTION_KEY=
-      # - BOTFIGHTS_NWC_URL=
+      # Encrypts stored per-user NWC connection strings at rest (AES-256-GCM,
+      # server/src/engine/crypto.ts) — without it, "Connect NWC" 500s
+      # immediately (getKey() throws under NODE_ENV=production). Generated on
+      # the host into /opt/botfights-arena/.env (0600, never committed),
+      # same pattern as JWT_SECRET above.
+      - BOTFIGHTS_WALLET_ENCRYPTION_KEY=${BOTFIGHTS_WALLET_ENCRYPTION_KEY}
+      # Actual money movement is still deliberately NOT enabled (phase 09
+      # CONTEXT.md scope fence: "OUT: Lightning/cashu payment changes" — the
+      # encryption key above only lets per-user wallet strings be stored, it
+      # doesn't move any funds on its own). A Cashu-based fixed-stake
+      # ("winner takes all, 21 sats") entry-fee design is being scoped
+      # separately before any of these are set:
+      # - BOTFIGHTS_NWC_URL=              (the ARENA's OWN wallet — real funds)
       # - BOTFIGHTS_CASHU_MINT_URL=
       # - BOTFIGHTS_DEV_PAYOUT_LNADDRESS=