diff --git a/.env.example b/.env.example
index 15c8495..3b1d3c7 100644
--- a/.env.example
+++ b/.env.example
@@ -122,8 +122,10 @@ VITE_AUTHENTIK_URL=https://auth.firesuite.feuerwehr-rems.at
 
 # OAuth Client ID
 # From Authentik: Applications → Providers → Your Provider
-# REQUIRED for authentication to work!
+# Used by both the backend (AUTHENTIK_CLIENT_ID) and the frontend build (VITE_CLIENT_ID).
+# Set both to the same value from Authentik. REQUIRED for authentication to work!
 AUTHENTIK_CLIENT_ID=your_client_id_here
+VITE_CLIENT_ID=your_client_id_here
 
 # OAuth Client Secret
 # From Authentik: Applications → Providers → Your Provider
diff --git a/backend/src/config/environment.ts b/backend/src/config/environment.ts
index ac618c2..5d94542 100644
--- a/backend/src/config/environment.ts
+++ b/backend/src/config/environment.ts
@@ -1,12 +1,9 @@
 import dotenv from 'dotenv';
 import path from 'path';
 
-// Load environment-specific .env file
-const envFile = process.env.NODE_ENV === 'production'
-  ? '.env.production'
-  : '.env.development';
-
-dotenv.config({ path: path.resolve(__dirname, '../../', envFile) });
+// Load from root .env (project-wide single source of truth).
+// In Docker, env vars are already injected by docker-compose so this is a no-op.
+dotenv.config({ path: path.resolve(__dirname, '../../../.env') });
 
 interface EnvironmentConfig {
   nodeEnv: string;
diff --git a/docker-compose.yml b/docker-compose.yml
index 32ff5d7..2f6c15a 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -63,7 +63,7 @@ services:
       args:
         VITE_API_URL: ${VITE_API_URL:-https://start.feuerwehr-rems.at}
         VITE_AUTHENTIK_URL: ${VITE_AUTHENTIK_URL:?VITE_AUTHENTIK_URL is required}
-        VITE_CLIENT_ID: ${AUTHENTIK_CLIENT_ID:?AUTHENTIK_CLIENT_ID is required}
+        VITE_CLIENT_ID: ${VITE_CLIENT_ID:?VITE_CLIENT_ID is required}
     container_name: feuerwehr_frontend_prod
     labels:
       - "traefik.enable=true"
diff --git a/frontend/.env.development b/frontend/.env.development
index 167d9f7..bfc75d8 100644
--- a/frontend/.env.development
+++ b/frontend/.env.development
@@ -1,3 +1,3 @@
-VITE_API_URL=http://localhost:3000
-VITE_AUTHENTIK_URL=https://auth.firesuite.feuerwehr-rems.at
-VITE_CLIENT_ID=your_client_id_here
+# This file is no longer used.
+# All environment variables are read from the root .env file.
+# See /.env.example for the full list of required variables.
diff --git a/frontend/Dockerfile b/frontend/Dockerfile
index aff5178..1ec7ee6 100644
--- a/frontend/Dockerfile
+++ b/frontend/Dockerfile
@@ -19,11 +19,15 @@ COPY . .
 
 # Build arguments for environment variables
 ARG VITE_API_URL=http://localhost:3000
+ARG VITE_AUTHENTIK_URL
+ARG VITE_CLIENT_ID
 ARG VITE_APP_NAME="Feuerwehr Dashboard"
 ARG VITE_APP_VERSION="1.0.0"
 
 # Set environment variables for build
 ENV VITE_API_URL=$VITE_API_URL
+ENV VITE_AUTHENTIK_URL=$VITE_AUTHENTIK_URL
+ENV VITE_CLIENT_ID=$VITE_CLIENT_ID
 ENV VITE_APP_NAME=$VITE_APP_NAME
 ENV VITE_APP_VERSION=$VITE_APP_VERSION
 
diff --git a/frontend/vite.config.ts b/frontend/vite.config.ts
index 4a298d2..7c3c155 100644
--- a/frontend/vite.config.ts
+++ b/frontend/vite.config.ts
@@ -19,6 +19,7 @@ export default defineConfig({
       },
     },
   },
+  envDir: '../',
   build: {
     outDir: 'dist',
     sourcemap: true,