diff --git a/.gitignore b/.gitignore
index 33dcc61..df7f3dd 100644
--- a/.gitignore
+++ b/.gitignore
@@ -40,3 +40,4 @@ Thumbs.db
 
 # Codex R15 review outputs (local scratch)
 .reviews/
+docker/ring-mqtt/config.json
diff --git a/docker-compose.yml b/docker-compose.yml
index f579ade..469e142 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -96,12 +96,11 @@ services:
     depends_on:
       - mosquitto
     environment:
-      MQTTHOST: mosquitto
-      MQTTPORT: "1883"
-      MQTTUSER: ring
-      MQTTPASSWORD: ${MQTT_RING_PASSWORD}
+      RUNMODE: docker
     volumes:
       - ring-data:/data
+      # Generated by gen-passwd.sh (holds the broker mqtt_url); the token/state lives in ring-data.
+      - ./docker/ring-mqtt/config.json:/data/config.json:ro
     ports:
       # ring-mqtt setup/token web UI. Port may differ by ring-mqtt version — adjust if needed.
       - "${RING_UI_PORT:-55123}:55123"
diff --git a/docker/mosquitto/gen-passwd.sh b/docker/mosquitto/gen-passwd.sh
index 5288848..b83be9f 100755
--- a/docker/mosquitto/gen-passwd.sh
+++ b/docker/mosquitto/gen-passwd.sh
@@ -47,3 +47,9 @@ docker run --rm -e LPASS -e DPASS -e RPASS -e SPASS \
         chown '"$(id -u)"':'"$(id -g)"' /cfg/passwd && chmod 0644 /cfg/passwd
     '
 echo 'Mosquitto passwd generated (users: laravel, sidecar, ring, shelly).'
+
+# ring-mqtt bridge config — points the bridge at our broker as the least-privileged `ring` user.
+# Kept out of git (contains the password); the token/state stays in the ring-data volume.
+mkdir -p docker/ring-mqtt
+printf '{\n  "mqtt_url": "mqtt://ring:%s@mosquitto:1883"\n}\n' "$RPASS" > docker/ring-mqtt/config.json
+echo 'ring-mqtt config generated (docker/ring-mqtt/config.json).'
diff --git a/docker/ring-mqtt/config.json.example b/docker/ring-mqtt/config.json.example
new file mode 100644
index 0000000..8d154d4
--- /dev/null
+++ b/docker/ring-mqtt/config.json.example
@@ -0,0 +1,3 @@
+{
+  "mqtt_url": "mqtt://ring:REPLACED_BY_GEN_PASSWD@mosquitto:1883"
+}