diff --git a/.env b/.env
index 9769985..b7caa45 100644
--- a/.env
+++ b/.env
@@ -16,3 +16,7 @@ NEXTERM_DATA_DIR=./nexterm_data
 
 # Timezone del container
 NEXTERM_TZ=Europe/Rome
+
+# Chiave di cifratura usata da Nexterm (obbligatoria)
+# Sostituisci con una stringa lunga e casuale.
+NEXTERM_ENCRYPTION_KEY=change-this-to-a-long-random-secret
diff --git a/README.md b/README.md
index 0865ab0..1f7730c 100644
--- a/README.md
+++ b/README.md
@@ -25,6 +25,14 @@ Variabili principali:
 - `NEXTERM_PORT_CONTAINER`: porta interna del container
 - `NEXTERM_DATA_DIR`: directory dati persistenti
 - `NEXTERM_TZ`: timezone del container
+- `NEXTERM_ENCRYPTION_KEY`: chiave di cifratura obbligatoria per Nexterm
+
+> `NEXTERM_ENCRYPTION_KEY` deve essere una stringa lunga e casuale.
+> Esempio rapido (PowerShell):
+
+```powershell
+[Convert]::ToBase64String((1..48 | ForEach-Object { Get-Random -Maximum 256 }))
+```
 
 ## Avvio
 
diff --git a/docker-compose.yml b/docker-compose.yml
index 9479b11..0580cd6 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -9,4 +9,5 @@ services:
       - ${NEXTERM_DATA_DIR}:/app/data
     environment:
       - PORT=${NEXTERM_PORT_CONTAINER}
-      - TZ=${NEXTERM_TZ}
\ No newline at end of file
+      - TZ=${NEXTERM_TZ}
+      - ENCRYPTION_KEY=${NEXTERM_ENCRYPTION_KEY}
\ No newline at end of file