diff --git a/docker-compose.yml b/docker-compose.yml
index f6cf2d7..f0973f6 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -3,6 +3,18 @@ name: adventureland
 # ensure both containers use same version of mongo
 x-mongo_image: &mongo_image mongo:8.0
 
+# One source of truth for the database connection and the DRM switch.
+# Merged into every app service with `<<: *app-env`, so a service that adds
+# its own variables (e.g. al-backend with AL_GAME_*) does not silently
+# replace the whole environment block and lose these.
+x-app-env: &app-env
+  MONGODB_URI: mongodb://al-mongo:27017/adventureland?replicaSet=rs0
+  MONGODB_NAME: adventureland
+  # See docker/patch-drm-check.js: without Steam/MAS auth a self-hosted
+  # server would flag every account with "Authorization Failure".
+  # Set to "1" to restore the upstream DRM check.
+  AL_DRM_CHECK: "0"
+
 # Shared settings for the two game containers. Both use the same image, so
 # `docker compose build` builds it once.
 x-app: &app
@@ -17,12 +29,7 @@ x-app: &app
   restart: unless-stopped
   init: true
   environment:
-    MONGODB_URI: mongodb://al-mongo:27017/adventureland?replicaSet=rs0
-    MONGODB_NAME: adventureland
-    # See docker/patch-drm-check.js: without Steam/MAS auth a self-hosted
-    # server would flag every account with "Authorization Failure".
-    # Set to "1" to restore the upstream DRM check.
-    AL_DRM_CHECK: "0"
+    <<: *app-env
   volumes:
     # Editable keys/options from the host (replaces the cloned template).
     - ./files/config:/app/secretsandconfig:ro
@@ -81,6 +88,9 @@ services:
     <<: *app
     command: ["node", "main.js"]
     environment:
+      # Keep the shared DB/DRM settings; this block replaces the anchor's
+      # `environment` mapping, so it must merge them back in explicitly.
+      <<: *app-env
       # See docker/entrypoint.sh: lets the backend reach the game server at
       # the address it advertises to browsers (localhost:7192).
       AL_GAME_RELAY: "1"