diff --git a/docker-compose.qa.yml b/docker-compose.qa.yml
index 65a1d78..3fb87fd 100644
--- a/docker-compose.qa.yml
+++ b/docker-compose.qa.yml
@@ -37,6 +37,9 @@
 #   QA_SMTP_USER    — Brevo SMTP login. Named QA_ for the same reason as the
 #   QA_SMTP_PASSWORD  database password: pasting production's variables in here
 #   QA_SMTP_FROM      must not silently work.
+#   ADMIN_GATE_SECRET — the shared secret Nginx Proxy Manager injects as the
+#                     X-Admin-Gate header on the gated location. Both sides must
+#                     hold the same value or the admin API returns 403. See #63.
 
 services:
   redefined-designs-qa:
@@ -98,6 +101,19 @@ services:
       - SITE_CURRENCY=USD
       - RESERVATION_MINUTES=15
       - PUBLIC_URL=${PUBLIC_URL}
+
+      # Required since #64, and previously inherited from the code's fallback —
+      # which is exactly what that change set out to stop. Hardcoded rather than
+      # taken from a stack variable because it is not a secret and because it
+      # has to match the right-hand side of the volume mapping below; splitting
+      # it across two files is how they drift apart.
+      - UPLOADS_DIR=/app/uploads
+
+      # Interpolated from the stack environment so the secret itself never
+      # enters the repository. Note that setting it in Portainer alone is not
+      # enough: stack variables are substituted into this file, not handed to
+      # the container, so a variable with no line here never reaches the app.
+      - ADMIN_GATE_SECRET=${ADMIN_GATE_SECRET}
     volumes:
       # Separate uploads directory. Sharing production's would let a QA run
       # write into, and a QA teardown delete, real product images.