diff --git a/.env.local.example b/.env.local.example
index f9e601f..c49d823 100644
--- a/.env.local.example
+++ b/.env.local.example
@@ -1,14 +1,27 @@
-# Simple PIN gate (the user enters this PIN on the login screen).
-# Change this value to whatever PIN you want on the construction site.
+# PIN gate — change this in production. Exposed to the client because the
+# lock screen validates it locally before talking to PocketBase.
 NEXT_PUBLIC_APP_PIN=2468
 
-# Optional: name shown on the lock screen and header.
-NEXT_PUBLIC_APP_NAME="MEGA INFRASTRUCTURE"
-
-# Optional: switch the default theme. Use "light" or "dark".
+# Brand
+NEXT_PUBLIC_APP_NAME=MEGA INFRASTRUCTURE
 NEXT_PUBLIC_DEFAULT_THEME=light
 
-# Optional: when you wire up PocketBase / a backend, point at it here.
+# Local API base URL (the Next.js app's own /api routes — currently a stub)
 NEXT_PUBLIC_API_BASE_URL=http://localhost:3000/api
-POCKETBASE_URL=
-POCKETBASE_TOKEN=
+
+# ── PocketBase ─────────────────────────────────────────────────────────────
+# Public client-side URL. Safe to expose because PocketBase handles
+# auth at the collection-rule level — public reads need a token, the
+# URL alone is not a credential.
+NEXT_PUBLIC_POCKETBASE_URL=https://your-pocketbase.example.com
+
+# Server-side only — used by Next.js server components / route handlers
+# to seed data, sync files and run admin operations. NEVER prefix with
+# NEXT_PUBLIC_ or the credentials leak into every browser bundle.
+POCKETBASE_ADMIN_EMAIL=admin@example.com
+POCKETBASE_ADMIN_PASSWORD=change-me
+
+# If you have an existing auth token you can paste it here instead of
+# having the server re-authenticate on every cold start. Leave blank
+# to let the server log in with the email + password above.
+POCKETBASE_ADMIN_TOKEN=