diff --git a/be/.env.example b/be/.env.example
index 6b24fa6..dcd7651 100644
--- a/be/.env.example
+++ b/be/.env.example
@@ -1,9 +1,10 @@
 # Host ports (change these if they collide on your single server)
 BACKEND_HOST_PORT=8080
-MYSQL_HOST_PORT=3306
+# MySQL is internal-only (not published to the host)
 
 # MySQL
-MYSQL_ROOT_PASSWORD=password
+# Quote if the password contains special chars like ; # $
+MYSQL_ROOT_PASSWORD="password"
 MYSQL_DATABASE=qms
 
 # App
diff --git a/be/.env.production b/be/.env.production
index d872f50..2804314 100644
--- a/be/.env.production
+++ b/be/.env.production
@@ -1,9 +1,9 @@
 # Host ports (change these if they collide on your single server)
 BACKEND_HOST_PORT=8080
-MYSQL_HOST_PORT=3306
+# MySQL is internal-only (not published to the host)
 
 # MySQL
-MYSQL_ROOT_PASSWORD=R8qjjBJDg9NtL2IwcnoFMkn8pktwAZ;wsl
+MYSQL_ROOT_PASSWORD="R8qjjBJDg9NtL2IwcnoFMkn8pktwAZ;wsl"
 MYSQL_DATABASE=qms
 
 # App
diff --git a/be/docker-compose.yml b/be/docker-compose.yml
index ca1e68d..03cc2c4 100644
--- a/be/docker-compose.yml
+++ b/be/docker-compose.yml
@@ -3,9 +3,8 @@ services:
     image: mysql:8
     container_name: qms-mysql
     restart: unless-stopped
-    ports:
-      # Host port can be changed via MYSQL_HOST_PORT in .env (default 3306)
-      - "${MYSQL_HOST_PORT:-3306}:3306"
+    # Do not publish 3306 to the host — avoids clashes with host MySQL.
+    # Backend reaches it as hostname "mysql" on the internal Docker network.
     environment:
       MYSQL_ROOT_PASSWORD: ${MYSQL_ROOT_PASSWORD:-password}
       MYSQL_DATABASE: ${MYSQL_DATABASE:-qms}