diff --git a/docker-compose.yml b/docker-compose.yml
index 035d9aa..a495bfa 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -43,6 +43,8 @@ services:
       # embedding the secret in the compose file.
       CYCLONE_ADMIN_USERNAME_FILE: "/run/secrets/cyclone_admin_username"
       CYCLONE_ADMIN_PASSWORD_FILE: "/run/secrets/cyclone_admin_password"
+      # SP26 — SFTP password via Docker secret (matches the admin-creds pattern).
+      CYCLONE_SFTP_PASSWORD_FILE: "/run/secrets/cyclone_sftp_password"
       # Bind 0.0.0.0 so the frontend container on the compose bridge
       # network can reach us. The bridge network provides isolation —
       # only the `frontend` service is on it; the host firewall still
@@ -52,6 +54,7 @@ services:
       - cyclone_db_key
       - cyclone_admin_username
       - cyclone_admin_password
+      - cyclone_sftp_password
     volumes:
       - cyclone_db:/var/lib/cyclone/db
       - cyclone_backups:/var/lib/cyclone/backups
@@ -91,6 +94,8 @@ secrets:
     file: /etc/cyclone/secrets/admin_username
   cyclone_admin_password:
     file: /etc/cyclone/secrets/admin_pw
+  cyclone_sftp_password:
+    file: /etc/cyclone/secrets/sftp_password
 
 volumes:
   cyclone_db: