diff --git a/docker-compose.dev.yml b/docker-compose.dev.yml
index 699a77a0..387ebd52 100644
--- a/docker-compose.dev.yml
+++ b/docker-compose.dev.yml
@@ -201,6 +201,39 @@ x-backend-env: &backend-env
   VULN_SLA_DAYS_HIGH: ${VULN_SLA_DAYS_HIGH:-30}
   VULN_SLA_DAYS_MEDIUM: ${VULN_SLA_DAYS_MEDIUM:-90}
   VULN_SLA_DAYS_LOW: ${VULN_SLA_DAYS_LOW:-180}
+  # compose-env-var wiring audit: scan executor selection, Docker sidecar
+  # hardening (resource caps, capabilities, network, volume strategy), Android
+  # scan image selection, and scan-log persistence/retention. Documented in
+  # .env.example but never listed in this anchor, so setting any of them in
+  # .env had no effect on the running container. Defaults match
+  # core/config.py exactly, so an unset .env changes nothing for an existing
+  # deployment.
+  SCAN_ALLOW_UNPINNED_IMAGE: ${SCAN_ALLOW_UNPINNED_IMAGE:-}
+  SCAN_ANDROID_API_DEFAULT: ${SCAN_ANDROID_API_DEFAULT:-34}
+  SCAN_ANDROID_IMAGE_PREFIX: ${SCAN_ANDROID_IMAGE_PREFIX:-ghcr.io/sktelecom/sbom-scanner-android-sdk}
+  SCAN_ANDROID_IMAGE_TAG: ${SCAN_ANDROID_IMAGE_TAG:-latest}
+  SCAN_AVERAGE_DURATION_SECONDS: ${SCAN_AVERAGE_DURATION_SECONDS:-1200}
+  SCAN_DOCKER_VOLUME_STRATEGY: ${SCAN_DOCKER_VOLUME_STRATEGY:-named}
+  SCAN_EXECUTOR: ${SCAN_EXECUTOR:-inprocess}
+  SCAN_LOCAL_DOCKER_ENVS: ${SCAN_LOCAL_DOCKER_ENVS:-android}
+  SCAN_LOG_LINE_MAX_LEN: ${SCAN_LOG_LINE_MAX_LEN:-2000}
+  SCAN_LOG_MAX_LINES_PER_SCAN: ${SCAN_LOG_MAX_LINES_PER_SCAN:-20000}
+  SCAN_LOG_PERSIST_ENABLED: ${SCAN_LOG_PERSIST_ENABLED:-true}
+  SCAN_QUEUE_SLOT_COUNT: ${SCAN_QUEUE_SLOT_COUNT:-2}
+  SCAN_RETENTION_KEEP_LAST: ${SCAN_RETENTION_KEEP_LAST:-30}
+  SCAN_RETENTION_MAX_AGE_DAYS: ${SCAN_RETENTION_MAX_AGE_DAYS:-180}
+  SCAN_RETENTION_SUPERSEDED_GRACE_DAYS: ${SCAN_RETENTION_SUPERSEDED_GRACE_DAYS:-7}
+  SCAN_SIDECAR_CAP_ADD: ${SCAN_SIDECAR_CAP_ADD:-CHOWN,DAC_OVERRIDE,FOWNER,SETGID,SETUID}
+  SCAN_SIDECAR_CAP_DROP: ${SCAN_SIDECAR_CAP_DROP:-ALL}
+  SCAN_SIDECAR_CPUS: ${SCAN_SIDECAR_CPUS:-2}
+  SCAN_SIDECAR_MEMORY: ${SCAN_SIDECAR_MEMORY:-4g}
+  SCAN_SIDECAR_NETWORK: ${SCAN_SIDECAR_NETWORK:-}
+  SCAN_SIDECAR_PIDS_LIMIT: ${SCAN_SIDECAR_PIDS_LIMIT:-4096}
+  SCAN_VOLUMES_FROM_ACK: ${SCAN_VOLUMES_FROM_ACK:-}
+  SCAN_WORKER_CONTAINER: ${SCAN_WORKER_CONTAINER:-}
+  SCAN_WORKSPACE_MOUNT: ${SCAN_WORKSPACE_MOUNT:-/tmp/trustedoss}
+  SCAN_WORKSPACE_VOLUME: ${SCAN_WORKSPACE_VOLUME:-}
+  STALE_RUNNING_SCAN_GRACE_SECONDS: ${STALE_RUNNING_SCAN_GRACE_SECONDS:-900}
 
 services:
   postgres:
diff --git a/docker-compose.yml b/docker-compose.yml
index da31b5f3..2a65b77b 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -289,6 +289,45 @@ x-backend-env: &backend-env
   VULN_SLA_DAYS_HIGH: ${VULN_SLA_DAYS_HIGH:-30}
   VULN_SLA_DAYS_MEDIUM: ${VULN_SLA_DAYS_MEDIUM:-90}
   VULN_SLA_DAYS_LOW: ${VULN_SLA_DAYS_LOW:-180}
+  # compose-env-var wiring audit: scan executor selection, Docker sidecar
+  # hardening (resource caps, capabilities, network, volume strategy), Android
+  # scan image selection, and scan-log persistence/retention. Documented in
+  # .env.example but never listed in this anchor, so setting any of them in
+  # .env had no effect on the running container. Defaults match
+  # core/config.py exactly, so an unset .env changes nothing for an existing
+  # deployment.
+  SCAN_ALLOW_UNPINNED_IMAGE: ${SCAN_ALLOW_UNPINNED_IMAGE:-}
+  SCAN_ANDROID_API_DEFAULT: ${SCAN_ANDROID_API_DEFAULT:-34}
+  SCAN_ANDROID_IMAGE_PREFIX: ${SCAN_ANDROID_IMAGE_PREFIX:-ghcr.io/sktelecom/sbom-scanner-android-sdk}
+  SCAN_ANDROID_IMAGE_TAG: ${SCAN_ANDROID_IMAGE_TAG:-latest}
+  SCAN_AVERAGE_DURATION_SECONDS: ${SCAN_AVERAGE_DURATION_SECONDS:-1200}
+  SCAN_DOCKER_VOLUME_STRATEGY: ${SCAN_DOCKER_VOLUME_STRATEGY:-named}
+  SCAN_EXECUTOR: ${SCAN_EXECUTOR:-inprocess}
+  SCAN_LOCAL_DOCKER_ENVS: ${SCAN_LOCAL_DOCKER_ENVS:-android}
+  SCAN_LOG_LINE_MAX_LEN: ${SCAN_LOG_LINE_MAX_LEN:-2000}
+  SCAN_LOG_MAX_LINES_PER_SCAN: ${SCAN_LOG_MAX_LINES_PER_SCAN:-20000}
+  SCAN_LOG_PERSIST_ENABLED: ${SCAN_LOG_PERSIST_ENABLED:-true}
+  SCAN_QUEUE_SLOT_COUNT: ${SCAN_QUEUE_SLOT_COUNT:-2}
+  SCAN_RETENTION_KEEP_LAST: ${SCAN_RETENTION_KEEP_LAST:-30}
+  SCAN_RETENTION_MAX_AGE_DAYS: ${SCAN_RETENTION_MAX_AGE_DAYS:-180}
+  SCAN_RETENTION_SUPERSEDED_GRACE_DAYS: ${SCAN_RETENTION_SUPERSEDED_GRACE_DAYS:-7}
+  SCAN_SIDECAR_CAP_ADD: ${SCAN_SIDECAR_CAP_ADD:-CHOWN,DAC_OVERRIDE,FOWNER,SETGID,SETUID}
+  SCAN_SIDECAR_CAP_DROP: ${SCAN_SIDECAR_CAP_DROP:-ALL}
+  SCAN_SIDECAR_CPUS: ${SCAN_SIDECAR_CPUS:-2}
+  SCAN_SIDECAR_MEMORY: ${SCAN_SIDECAR_MEMORY:-4g}
+  SCAN_SIDECAR_NETWORK: ${SCAN_SIDECAR_NETWORK:-}
+  SCAN_SIDECAR_PIDS_LIMIT: ${SCAN_SIDECAR_PIDS_LIMIT:-4096}
+  SCAN_VOLUMES_FROM_ACK: ${SCAN_VOLUMES_FROM_ACK:-}
+  SCAN_WORKER_CONTAINER: ${SCAN_WORKER_CONTAINER:-}
+  # NOTE: /workspace here (not the /tmp/trustedoss code default), because this file's
+  # named volume mounts the worker/beat/backend at /workspace (see the
+  # `volumes:` section below). _docker_volume._workspace_mount()'s own
+  # docstring says as much: "prod sets this to /workspace." A docker-executor
+  # sidecar must see the same mount point the worker itself uses, or
+  # source_dir resolution breaks.
+  SCAN_WORKSPACE_MOUNT: ${SCAN_WORKSPACE_MOUNT:-/workspace}
+  SCAN_WORKSPACE_VOLUME: ${SCAN_WORKSPACE_VOLUME:-}
+  STALE_RUNNING_SCAN_GRACE_SECONDS: ${STALE_RUNNING_SCAN_GRACE_SECONDS:-900}
 
 services:
   # ---------------------------------------------------------------------------