diff --git a/.env.gpu b/.env.gpu
new file mode 100644
index 0000000..9253dcd
--- /dev/null
+++ b/.env.gpu
@@ -0,0 +1,11 @@
+# GPU worker env - connects to L1 host via public IP (cross-VPC)
+REDIS_URL=redis://138.68.142.139:16379/5
+DATABASE_URL=postgresql://artdag:f960bcc61d8b2155a1d57f7dd72c1c58@138.68.142.139:15432/artdag
+IPFS_API=/ip4/138.68.142.139/tcp/15001
+IPFS_GATEWAYS=https://ipfs.io,https://cloudflare-ipfs.com,https://dweb.link
+IPFS_GATEWAY_URL=https://celery-artdag.rose-ash.com/ipfs
+CACHE_DIR=/data/cache
+C_FORCE_ROOT=true
+ARTDAG_CLUSTER_KEY=
+NVIDIA_VISIBLE_DEVICES=all
+STREAMING_GPU_PERSIST=0
diff --git a/.gitea/workflows/ci.yml b/.gitea/workflows/ci.yml
index c9dd1ac..a0a0ed3 100644
--- a/.gitea/workflows/ci.yml
+++ b/.gitea/workflows/ci.yml
@@ -55,7 +55,6 @@ jobs:
         run: |
           ssh "root@$DEPLOY_HOST" "
             cd /root/art-dag/celery
-            set -a && source .env && set +a
             docker stack deploy -c docker-compose.yml celery
             echo 'Waiting for services to update...'
             sleep 10
diff --git a/docker-compose.yml b/docker-compose.yml
index a6a64b9..6367905 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -21,9 +21,10 @@ services:
 
   postgres:
     image: postgres:16-alpine
+    env_file:
+      - .env
     environment:
       - POSTGRES_USER=artdag
-      - POSTGRES_PASSWORD=${POSTGRES_PASSWORD}
       - POSTGRES_DB=artdag
     ports:
       - target: 5432
@@ -69,16 +70,10 @@ services:
       - .env
     environment:
       - REDIS_URL=redis://redis:6379/5
-      - DATABASE_URL=postgresql://artdag:${POSTGRES_PASSWORD}@postgres:5432/artdag
-      - ADMIN_TOKEN=${ADMIN_TOKEN}
       # IPFS_API multiaddr - used for all IPFS operations (add, cat, pin)
       - IPFS_API=/dns/ipfs/tcp/5001
       - CACHE_DIR=/data/cache
-      # Set IPFS_PRIMARY=true to use IPFS-primary mode (everything on IPFS, no local cache)
-      # - IPFS_PRIMARY=true
-      # Cluster key for trust domains - systems with same key can share work via IPFS
-      # Generate with: openssl rand -hex 32
-      - ARTDAG_CLUSTER_KEY=${ARTDAG_CLUSTER_KEY:-}
+      # DATABASE_URL, ADMIN_TOKEN, ARTDAG_CLUSTER_KEY,
       # L2_SERVER, L2_DOMAIN, IPFS_GATEWAY_URL from .env file
     volumes:
       - l1_cache:/data/cache
@@ -100,15 +95,15 @@ services:
   l1-worker:
     image: registry.rose-ash.com:5000/celery-l1-server:latest
     command: sh -c "find /app -type d -name __pycache__ -exec rm -rf {} + 2>/dev/null; celery -A celery_app worker --loglevel=info -E"
+    env_file:
+      - .env
     environment:
       - REDIS_URL=redis://redis:6379/5
-      - DATABASE_URL=postgresql://artdag:${POSTGRES_PASSWORD}@postgres:5432/artdag
       # IPFS_API multiaddr - used for all IPFS operations (add, cat, pin)
       - IPFS_API=/dns/ipfs/tcp/5001
       - CACHE_DIR=/data/cache
       - C_FORCE_ROOT=true
-      # Must match l1-server for consistent cache_ids
-      - ARTDAG_CLUSTER_KEY=${ARTDAG_CLUSTER_KEY:-}
+      # DATABASE_URL, ARTDAG_CLUSTER_KEY from .env file
     volumes:
       - l1_cache:/data/cache
     depends_on:
@@ -149,29 +144,9 @@ services:
   # Requires: docker node update --label-add gpu=true <gpu-node-name>
   l1-gpu-worker:
     image: registry.rose-ash.com:5000/celery-l1-gpu-server:latest
-    # For local dev, uncomment to build from Dockerfile.gpu:
-    # build:
-    #   context: .
-    #   dockerfile: Dockerfile.gpu
     command: sh -c "cd /app && celery -A celery_app worker --loglevel=info -E -Q gpu,celery"
-    environment:
-      # GPU node is on different VPC - use public IPs for cross-node communication
-      - REDIS_URL=redis://${L1_HOST}:16379/5
-      - DATABASE_URL=postgresql://artdag:${POSTGRES_PASSWORD}@${L1_HOST}:15432/artdag
-      # Connect to shared IPFS node on CPU (via public IP)
-      - IPFS_API=/ip4/${L1_HOST}/tcp/15001
-      # Gateway fallback for resilience
-      - IPFS_GATEWAYS=https://ipfs.io,https://cloudflare-ipfs.com,https://dweb.link
-      # Local cache is ephemeral (tmpfs or local volume)
-      - CACHE_DIR=/data/cache
-      - C_FORCE_ROOT=true
-      - ARTDAG_CLUSTER_KEY=${ARTDAG_CLUSTER_KEY:-}
-      # GPU acceleration settings
-      - NVIDIA_VISIBLE_DEVICES=all
-      # GPU persistence disabled until all primitives support GPU frames
-      - STREAMING_GPU_PERSIST=0
-      # Use our public IPFS gateway for HLS segment URLs
-      - IPFS_GATEWAY_URL=https://celery-artdag.rose-ash.com/ipfs
+    env_file:
+      - .env.gpu
     volumes:
       # Local cache - ephemeral, just for working files
       - gpu_cache:/data/cache