diff --git a/.env.example b/.env.example
new file mode 100644
index 0000000..2a2b258
--- /dev/null
+++ b/.env.example
@@ -0,0 +1,2 @@
+# Path to the Plex config INI file (default: ~/.plexconfig.ini)
+# PLEXADM_CONFIG=/path/to/.plexconfig.ini
diff --git a/README.md b/README.md
index 8c61305..6e96e09 100644
--- a/README.md
+++ b/README.md
@@ -573,3 +573,22 @@ bash scripts/mass_process.sh
 ## Naming Scheme
 
 See [docs/naming-scheme.md](./docs/naming-scheme.md).
+
+## Using a .env file
+
+Rather than embedding credentials in your `docker-compose.yml`, you can store them in a `.env` file and bind-mount it into the container:
+
+```bash
+cp .env.example .env
+# edit .env with your values
+```
+
+```yaml
+services:
+  app:
+    image: ghcr.io/jasmeralia/plexscripts:latest
+    volumes:
+      - /path/to/your/.env:/app/.env:ro
+```
+
+The app loads `/app/.env` automatically on startup. Any value in `.env` can still be overridden by an explicit `environment:` entry in your Compose file.
\ No newline at end of file
diff --git a/plexadm/config.py b/plexadm/config.py
index c4518b7..3d5a466 100644
--- a/plexadm/config.py
+++ b/plexadm/config.py
@@ -5,6 +5,10 @@
 from dataclasses import dataclass
 from pathlib import Path
 
+from dotenv import load_dotenv
+
+load_dotenv()
+
 
 @dataclass(frozen=True)
 class PlexConfig:
diff --git a/requirements.txt b/requirements.txt
index 9587b2f..dda5c06 100644
--- a/requirements.txt
+++ b/requirements.txt
@@ -1 +1,3 @@
 plexapi
+
+pydantic-settings>=2.0