diff --git a/..env.swp b/..env.swp
new file mode 100644
index 0000000..3b2116a
Binary files /dev/null and b/..env.swp differ
diff --git a/.env.example b/.env.example
index 17d557d..9558b82 100644
--- a/.env.example
+++ b/.env.example
@@ -1,13 +1,18 @@
 # Copy this to .env and fill in values for local development.
 # In production, set these as environment variables / Kubernetes secrets.
+#
+# NOTE: Values containing $ must be quoted with single quotes + backslashes:
+#   PASSWORD_HASH='$2b$12$...'
 
-# Comma-separated list of additional allowed CORS origins.
-# Add your dev machine's IP here if accessing via IP address.
-# e.g. ALLOWED_ORIGINS=http://192.168.0.94:5173
-ALLOWED_ORIGINS=
+# bcrypt hash of the admin password. Generate with:
 #   python3 -c "import bcrypt; print(bcrypt.hashpw(b'yourpassword', bcrypt.gensalt(rounds=12)).decode())"
 PASSWORD_HASH=
 
 # Random secret for signing session tokens. Generate with:
 #   openssl rand -hex 32
 SESSION_SECRET=
+
+# Comma-separated list of additional allowed origins for CSRF.
+# Add your dev machine's IP here if accessing via IP address.
+# e.g. ALLOWED_ORIGINS=http://192.168.0.94:5173
+ALLOWED_ORIGINS=