diff --git a/.env.template b/.env.template
index 4fecc16e..9c9ba4ea 100644
--- a/.env.template
+++ b/.env.template
@@ -7,6 +7,11 @@ YUXI_ENV=development
 JWT_SECRET_KEY=
 YUXI_INSTANCE_ID=
 
+# 敏感字段加密密钥：用于加密配置中的 password/token/api_key 等敏感字段
+# 生产环境必须设置；留空时敏感字段将以明文存储（仅开发环境兼容）
+# 生成方式：python -c "from cryptography.fernet import Fernet; print(Fernet.generate_key().decode())"
+ENCRYPTION_KEY=
+
 # # 其余可选配置
 # OPENAI_API_KEY=
 # OPENAI_API_BASE=
diff --git a/docker-compose.yml b/docker-compose.yml
index 95ec4c9d..6fc9b89d 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -29,6 +29,8 @@ x-api-worker-env: &api-worker-env
   # Agent run
   RUN_CANCEL_KEY_TTL_SECONDS: ${RUN_CANCEL_KEY_TTL_SECONDS:-1800}
   RUN_EVENTS_STREAM_TTL_SECONDS: ${RUN_EVENTS_STREAM_TTL_SECONDS:-7200}
+  # 敏感字段加密密钥
+  ENCRYPTION_KEY: ${ENCRYPTION_KEY:-}
   # 其他环境变量
   NO_PROXY: localhost,127.0.0.1,milvus,graph,minio,milvus-etcd-dev,etcd,mineru,paddlex,sandbox-provisioner,api.siliconflow.cn
   no_proxy: localhost,127.0.0.1,milvus,graph,minio,milvus-etcd-dev,etcd,mineru,paddlex,sandbox-provisioner,api.siliconflow.cn