diff --git a/docker/compose.yml b/docker/compose.yml
index e6cb3b8..a80656f 100644
--- a/docker/compose.yml
+++ b/docker/compose.yml
@@ -150,6 +150,10 @@ services:
       # and every issued token with it.
       - MCP_ENABLED=${MCP_ENABLED-false}
       - OAUTH_PRIVATE_KEY_FILE=/data/oauth-key.pem
+      # The portal enrolment, for the same reason: it holds this installation's
+      # credential and the key it pinned, so losing it on a rebuild would mean
+      # enrolling again by hand. Absent until someone connects a portal.
+      - CLOUD_CONFIG_FILE=/data/cloud.json
 
     volumes:
       - app-flow-data:/data