diff --git a/.env.example b/.env.example
index dd2e453..cadd045 100644
--- a/.env.example
+++ b/.env.example
@@ -13,7 +13,7 @@ GEMMA_API_KEY=not-needed
 # LiveKit (generated in livekit.yaml, referenced here for the agent)
 LIVEKIT_URL=http://localhost:7880
 LIVEKIT_API_KEY=devkey
-LIVEKIT_API_SECRET=devsecret
+LIVEKIT_API_SECRET=hopevoice-devsecret-2026-lan-only
 
 # Web UI port (9178 avoids the existing Unraid service on 8090)
 WEB_PORT=9178
diff --git a/docker-compose.yml b/docker-compose.yml
index d6ba2dc..f8e49e2 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -6,7 +6,7 @@ services:
     environment:
       LIVEKIT_URL: "http://localhost:7880"
       LIVEKIT_API_KEY: "${LIVEKIT_API_KEY:-devkey}"
-      LIVEKIT_API_SECRET: "${LIVEKIT_API_SECRET:-devsecret}"
+      LIVEKIT_API_SECRET: "${LIVEKIT_API_SECRET:-hopevoice-devsecret-2026-lan-only}"
       AZURE_SPEECH_KEY: "${AZURE_SPEECH_KEY:?Set AZURE_SPEECH_KEY in .env}"
       AZURE_SPEECH_REGION: "${AZURE_SPEECH_REGION:-eastus}"
       AZURE_TTS_VOICE: "${AZURE_TTS_VOICE:-en-US-Ava:DragonHDOmniLatestNeural}"
diff --git a/livekit.yaml b/livekit.yaml
index 0739d00..786a00e 100644
--- a/livekit.yaml
+++ b/livekit.yaml
@@ -5,7 +5,7 @@ rtc:
   udp_port: 7882
 
 keys:
-  devkey: devsecret
+  devkey: hopevoice-devsecret-2026-lan-only
 
 # Rooms are short-lived: each browser session gets a unique room name, so
 # the agent is dispatched at room creation. Default 300s cleanup is fine.