diff --git a/Dockerfile b/Dockerfile
index 842dc53..5645972 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -2,7 +2,7 @@
 # Builds a minimal production image for the Go server
 
 # Stage 1: Build
-FROM golang:1.24-alpine AS builder
+FROM golang:1.25-alpine AS builder
 
 # Install build dependencies
 RUN apk add --no-cache git ca-certificates tzdata
diff --git a/docker-compose.prod.yml b/docker-compose.prod.yml
index 95a559c..3aa1fc0 100644
--- a/docker-compose.prod.yml
+++ b/docker-compose.prod.yml
@@ -86,6 +86,11 @@ services:
       OAUTH_REDIRECT_URI: ${OAUTH_REDIRECT_URI}
       OAUTH_SEAL_SECRET: ${OAUTH_SEAL_SECRET}
 
+      # OAuth Confidential Client (optional - enables 1-year sessions instead of 14-day)
+      # Generate keys with: go run ./cmd/tools/generate-oauth-key
+      OAUTH_CLIENT_PRIVATE_KEY: ${OAUTH_CLIENT_PRIVATE_KEY:-}
+      OAUTH_CLIENT_KEY_ID: ${OAUTH_CLIENT_KEY_ID:-}
+
       # Application settings
       PORT: 8080
       ENV: production