diff --git a/.claude/settings.local.json b/.claude/settings.local.json
index 3dace0d..472f475 100644
--- a/.claude/settings.local.json
+++ b/.claude/settings.local.json
@@ -10,7 +10,8 @@
       "Bash(pip3 install:*)",
       "Bash(/Users/jeet/Library/Python/3.9/bin/pytest -v 2>&1)",
       "Bash(conda run:*)",
-      "Bash(git rm:*)"
+      "Bash(git rm:*)",
+      "Bash(git remote:*)"
     ]
   }
 }
diff --git a/backend/__pycache__/config.cpython-312.pyc b/backend/__pycache__/config.cpython-312.pyc
index 951586a..249281c 100644
Binary files a/backend/__pycache__/config.cpython-312.pyc and b/backend/__pycache__/config.cpython-312.pyc differ
diff --git a/backend/config.py b/backend/config.py
index b6af407..162a936 100644
--- a/backend/config.py
+++ b/backend/config.py
@@ -1,4 +1,4 @@
-from pydantic_settings import BaseSettings # type: ignore
+from pydantic_settings import BaseSettings, SettingsConfigDict  # type: ignore
 from functools import lru_cache
 
 
@@ -9,9 +9,11 @@ class Settings(BaseSettings):
     environment: str = "development"
     frontend_url: str = "http://localhost:8000"
 
-    class Config:
-        env_file = ".env"
-        case_sensitive = False
+    model_config = SettingsConfigDict(
+        env_file=".env",
+        case_sensitive=False,
+        extra="ignore",  # ignore unknown env vars (e.g. VITE_* from root .env)
+    )
 
 
 @lru_cache()
diff --git a/docker-compose.yml b/docker-compose.yml
index 759bc10..950406f 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -37,11 +37,14 @@ services:
 
   mongo:
     image: mongo:6
-    command: ["mongod", "--bind_ip", "0.0.0.0"]
+    command: ["mongod", "--bind_ip", "0.0.0.0", "--auth"]
+    environment:
+      MONGO_INITDB_ROOT_USERNAME: ${MONGO_USERNAME}
+      MONGO_INITDB_ROOT_PASSWORD: ${MONGO_PASSWORD}
     volumes:
       - mongo_data:/data/db
     healthcheck:
-      test: ["CMD", "mongosh", "--quiet", "--eval", "db.adminCommand('ping').ok"]
+      test: ["CMD", "mongosh", "--quiet", "-u", "${MONGO_USERNAME}", "-p", "${MONGO_PASSWORD}", "--authenticationDatabase", "admin", "--eval", "db.adminCommand('ping').ok"]
       interval: 10s
       timeout: 5s
       retries: 5