diff --git a/compose/.env-template b/compose/.env-template
new file mode 100644
index 0000000..64d7d60
--- /dev/null
+++ b/compose/.env-template
@@ -0,0 +1,22 @@
+###############################################################################
+# CodeTogether – Environment Template
+# -----------------------------------------------------------------------------
+# 1.  Copy this file to `.env` in the same directory as `compose.yaml`.
+# 2.  Replace the placeholders on the right‑hand side with your real values.
+#
+# Variables
+# ---------
+# COLLAB_FQDN   Public hostname (FQDN) that end‑users hit to reach the Collab
+#               service (e.g. collab.example.com).
+#
+# INTEL_FQDN    Public hostname (FQDN) for the Intel service
+#               (e.g. intel.example.com).
+#
+# INTEL_SECRET  Shared secret Collab uses to authenticate when authenticating 
+#               communication with the intel service.
+#               Use a strong, private value.
+###############################################################################
+
+COLLAB_FQDN=collab.example.com
+INTEL_FQDN=intel.example.com
+INTEL_SECRET=super-secret-string
\ No newline at end of file
diff --git a/compose/compose.yaml b/compose/compose.yaml
index 8d3b95b..cd52345 100644
--- a/compose/compose.yaml
+++ b/compose/compose.yaml
@@ -1,12 +1,13 @@
+# 👇 Rename `.env-template` to `.env` before running this file
+# Set the appropriate values once renamed
 services: 
   codetogether-collab:
     image: hub.edge.codetogether.com/releases/codetogether-collab:latest
     container_name: codetogether-collab
     environment:
-      # your collab/pair programming server URL
-      - CT_SERVER_URL=https://your-collab-server-fqdn
+      - CT_SERVER_URL=https://${COLLAB_FQDN}
       - CT_INTEL_URL=http://codetogether-intel:1080
-      - CT_INTEL_SECRET=your-collab-intel-secret
+      - CT_INTEL_SECRET=${INTEL_SECRET}
       - CT_AV_ENABLED=false
       - CT_AV_LAN_IP=auto
     networks:
@@ -31,8 +32,6 @@ services:
   codetogether-intel:
     image: hub.edge.codetogether.com/releases/codetogether-intel:latest
     container_name: codetogether-intel
-    environment:
-      - CT_HQ_BASE_URL=https://your-intel-server-fqdn
     networks:
       - codetogethernet
     volumes:
diff --git a/compose/cthq.properties b/compose/cthq.properties
index 1afe6b6..5c6e13c 100644
--- a/compose/cthq.properties
+++ b/compose/cthq.properties
@@ -1,8 +1,9 @@
-# Fill in values specific to your deployment
-hq.base.url=https://<server-fqdn>
-hq.collab.url=https://your-collab-server-fqdn
-hq.collab.secret=<your-collab-intel-secret>
+# Variables below are injected from the `.env` file
+hq.base.url=https://${INTEL_FQDN}
+hq.collab.url=https://${COLLAB_FQDN}
+hq.collab.secret=${INTEL_SECRET}
 
+# Fill in values specific to your deployment
 # THE LINE BELOW IS NOT NEEDED WITH SINGLE TENANT
 #hq.sso.tenants=github,gitlab
 # GitHub SSO
@@ -10,7 +11,7 @@ hq.sso.github.provider=github
 hq.sso.github.label=GitHub
 hq.sso.github.client.id=<github_client_id>
 hq.sso.github.client.secret=<github_client_secret>
-hq.sso.github.redirect.uri=https://<server-fqdn>/api/v1/auth/sso/success/insights
+hq.sso.github.redirect.uri=https://${INTEL_FQDN}/api/v1/auth/sso/success/insights
 hq.sso.github.auth.uri=https://github.com/login/oauth/authorize
 hq.sso.github.token.uri=https://github.com/login/oauth/access_token
 hq.sso.github.info.uri=https://api.github.com/user
@@ -22,7 +23,7 @@ hq.sso.github.logout.uri=https://github.com/logout
 # hq.sso.gitlab.client.id=<gitlab_client_id>
 # hq.sso.gitlab.client.secret=<gitlab_client_secret>
 # hq.sso.gitlab.client.issuer.url=https://gitlab.com
-# hq.sso.gitlab.azure.redirect.uri=https://<server-fqdn>/api/v1/auth/sso/success/insights
+# hq.sso.gitlab.azure.redirect.uri=https://${INTEL_FQDN}/api/v1/auth/sso/success/insights
 
 # These values do not need to be changed, though secrets can be updated
 hq.db.type=CASSANDRA