diff --git a/infra/disclosure-stack/docker-compose.yml b/infra/disclosure-stack/docker-compose.yml
index 4356b64..6bca109 100644
--- a/infra/disclosure-stack/docker-compose.yml
+++ b/infra/disclosure-stack/docker-compose.yml
@@ -129,7 +129,12 @@ services:
       DB_USER: supabase_admin
       DB_PASSWORD: ${POSTGRES_PASSWORD}
       DB_NAME: postgres
-      DB_ENC_KEY: ${VAULT_ENC_KEY}
+      # Realtime AES-128-ECB encrypts tenant secrets with this key. The key
+      # must be EXACTLY 16 bytes raw (not 32 hex chars). Sharing VAULT_ENC_KEY
+      # used to crash the container in a tight restart loop because that env
+      # is a 32-char hex string. Kept separate so the Vault extension can keep
+      # its own key shape.
+      DB_ENC_KEY: ${REALTIME_ENC_KEY}
       API_JWT_SECRET: ${JWT_SECRET}
       SECRET_KEY_BASE: ${SECRET_KEY_BASE}
       ERL_AFLAGS: -proto_dist inet_tcp