diff --git a/docker-compose.qa.yml b/docker-compose.qa.yml
index 090f94c..b553726 100644
--- a/docker-compose.qa.yml
+++ b/docker-compose.qa.yml
@@ -63,6 +63,14 @@
 #                     in the notification email (#224). Absent, the email still
 #                     sends and simply carries no shortcuts. Its own value, not
 #                     production's: a link signed with it acts without a login.
+#   QA_GOOGLE_CLIENT_ID — optional, and all-or-nothing with the secret below:
+#   QA_GOOGLE_CLIENT_SECRET  setting one without the other refuses to boot
+#                     (#340). Both unset means the Google button is simply not
+#                     offered, which is the right answer while QA lives on a
+#                     *.synology.me hostname — Google will not accept a redirect
+#                     URI whose domain nobody can prove they own, so a button
+#                     there could only ever fail. Set them once QA moves to
+#                     qa.redefined-designs.com (#313, #345).
 #   QA_REMBG_URL — optional. The background-removal sidecar, e.g.
 #                     http://rembg-syn:7000. Unset turns the feature off rather
 #                     than breaking anything. The sidecar must be on the same
@@ -195,20 +203,23 @@ services:
       # rotating it revokes every outstanding link, which is the intended way to
       # deal with a leak.
       - INTAKE_ACTION_SECRET=${QA_INTAKE_ACTION_SECRET:-}
-      # Deliberately left empty, and it is not an oversight (#340, #345).
+      # Read from the stack like every other QA secret, rather than hardcoded
+      # empty as they were in #340. Leaving them unreadable made this file the
+      # odd one out and cost a QA deploy: the variables were set on the stack,
+      # nothing read them, and the button stayed missing with no explanation.
       #
-      # Google refuses a redirect URI whose host is not under a domain whose
-      # ownership has been proved by DNS, and nobody can prove ownership of
-      # *.bermudalamb.synology.me because Synology owns the registrable domain
-      # above it. Same wall as #285. So QA cannot run Google sign-in at all
-      # while it lives on this hostname, and setting these would only produce a
-      # button that fails at Google.
+      # Leave them UNSET until QA moves off *.bermudalamb.synology.me. Google
+      # refuses a redirect URI whose host is not under a domain whose ownership
+      # has been proved by DNS, and nobody can prove ownership of that one,
+      # because Synology owns the registrable domain above it — the same wall
+      # #285 hit. Setting them today produces a button that fails at Google with
+      # redirect_uri_mismatch, and no console entry can satisfy it.
       #
-      # It becomes possible when #313 moves QA to qa.redefined-designs.com:
-      # set both here, set PUBLIC_URL to the new host, and add the matching
-      # callback in the Google Auth Platform. No code change either way.
-      - GOOGLE_CLIENT_ID=
-      - GOOGLE_CLIENT_SECRET=
+      # Once #313 moves QA to qa.redefined-designs.com: set these two, point
+      # PUBLIC_URL at the new host, and add the matching callback under Clients
+      # in the Google Auth Platform. No code change either way (#345).
+      - GOOGLE_CLIENT_ID=${QA_GOOGLE_CLIENT_ID:-}
+      - GOOGLE_CLIENT_SECRET=${QA_GOOGLE_CLIENT_SECRET:-}
     volumes:
       # Separate uploads directory. Sharing production's would let a QA run
       # write into, and a QA teardown delete, real product images.