diff --git a/apps/web/content/docs/self-hosting.mdx b/apps/web/content/docs/self-hosting.mdx
index 5436996ee0..5eb20947df 100644
--- a/apps/web/content/docs/self-hosting.mdx
+++ b/apps/web/content/docs/self-hosting.mdx
@@ -139,6 +139,22 @@ APPLE_CLIENT_SECRET=your-client-secret-jwt
 Apple client-secret JWTs expire, so rotate the secret before its configured
 expiration date.
 
+### Chrome Extension
+
+Required if you want to sign in to your instance from the Cap Chrome
+extension. Without it, the extension's login request is rejected with a
+`400 Bad Request` — the auth endpoint only accepts an unpinned extension id on
+localhost, because otherwise any installed extension could mint auth keys for
+a signed-in user.
+
+```bash
+CAP_CHROME_EXTENSION_ID=your-extension-id
+```
+
+Use the id shown for the extension on `chrome://extensions`. The Chrome Web
+Store build is `fefjaffcodfiogbbngmjkcjpbpclbdcp`; a locally loaded unpacked
+copy gets a different id, so set this to whichever build you actually use.
+
 ## Production Checklist
 
 <Warning title="Critical: Change Default Secrets Before Going Public">
diff --git a/docker-compose.coolify.env.example b/docker-compose.coolify.env.example
index 497cd18636..ccc8addfa4 100644
--- a/docker-compose.coolify.env.example
+++ b/docker-compose.coolify.env.example
@@ -78,3 +78,14 @@ GOOGLE_CLIENT_SECRET=
 # Sign in with Apple
 APPLE_CLIENT_ID=
 APPLE_CLIENT_SECRET=
+
+# ===================
+# CHROME EXTENSION (OPTIONAL)
+# ===================
+
+# Required to log in from the Cap Chrome extension. Without it the extension
+# auth endpoint rejects every redirect URI on a reachable deployment, since an
+# unpinned extension id would let any installed extension mint auth keys.
+# Use the extension id shown on chrome://extensions (the Web Store build is
+# fefjaffcodfiogbbngmjkcjpbpclbdcp).
+CAP_CHROME_EXTENSION_ID=
diff --git a/docker-compose.coolify.yml b/docker-compose.coolify.yml
index 35bad36594..91966fa3e7 100644
--- a/docker-compose.coolify.yml
+++ b/docker-compose.coolify.yml
@@ -29,6 +29,7 @@ services:
       GOOGLE_CLIENT_SECRET: ${GOOGLE_CLIENT_SECRET:-}
       APPLE_CLIENT_ID: ${APPLE_CLIENT_ID:-}
       APPLE_CLIENT_SECRET: ${APPLE_CLIENT_SECRET:-}
+      CAP_CHROME_EXTENSION_ID: ${CAP_CHROME_EXTENSION_ID:-}
       MEDIA_SERVER_URL: http://media-server:3456
       MEDIA_SERVER_WEBHOOK_SECRET: ${MEDIA_SERVER_WEBHOOK_SECRET}
       MEDIA_SERVER_WEBHOOK_URL: http://cap-web:3000
diff --git a/docker-compose.yml b/docker-compose.yml
index 039cefba12..6d1fb42f59 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -30,6 +30,7 @@ services:
       GOOGLE_CLIENT_SECRET: ${GOOGLE_CLIENT_SECRET:-}
       APPLE_CLIENT_ID: ${APPLE_CLIENT_ID:-}
       APPLE_CLIENT_SECRET: ${APPLE_CLIENT_SECRET:-}
+      CAP_CHROME_EXTENSION_ID: ${CAP_CHROME_EXTENSION_ID:-}
       MEDIA_SERVER_URL: http://media-server:3456
       MEDIA_SERVER_WEBHOOK_URL: http://cap-web:3000
     ports: