diff --git a/backend/src/lib/mqtt.js b/backend/src/lib/mqtt.js
index d55d895..a7f02fa 100644
--- a/backend/src/lib/mqtt.js
+++ b/backend/src/lib/mqtt.js
@@ -82,12 +82,15 @@ let reconnectAttempt = 0
 const discovered = new Map()
 
 async function getCredentials() {
-  // Primary path: env-injected credentials for this app's own dynsec client.
-  // The installer provisions a `hvac-backend` broker client and writes its
-  // creds into /opt/hvac/.env. This is the working model because the broker
-  // stores each client's password show-once (Mosquitto dynsec hashes it), so
-  // it genuinely cannot be re-served from settings at runtime — settings only
-  // reveals a new client's password once, at creation.
+  // Fetch this app's broker login from the central Settings service at runtime —
+  // same pattern (and same SETTINGS_SECRET) as newbook.js's getCredentials().
+  // An admin creates a `hvac-backend` *service* MQTT client on the Settings
+  // "MQTT Broker Clients" page; Settings stores its password encrypted and serves
+  // it here. Nothing broker-related lives in this app's .env.
+  //
+  // Env override (dev/emergency only, not set in production compose): if explicit
+  // MQTT_* vars are present they win, so the app can run against a local broker
+  // without Settings.
   if (process.env.MQTT_BROKER_HOST && process.env.MQTT_USERNAME && process.env.MQTT_PASSWORD) {
     return {
       host: process.env.MQTT_BROKER_HOST,
@@ -96,14 +99,12 @@ async function getCredentials() {
       password: process.env.MQTT_PASSWORD,
     }
   }
-  // Fallback: settings service (kept for the eventual self-service model — not
-  // wired yet; settings has no internal MQTT-credential serve endpoint today).
-  const url = `${process.env.SETTINGS_URL}/settings/api/internal/integration/mqtt?client=${CLIENT_NAME}`
+  const url = `${process.env.SETTINGS_URL}/settings/api/internal/mqtt-client/${CLIENT_NAME}`
   const res = await fetch(url, {
     headers: { Authorization: `Bearer ${process.env.SETTINGS_SECRET}` },
     signal: AbortSignal.timeout(5000),
   })
-  if (!res.ok) throw new Error(`Settings service returned ${res.status} fetching MQTT credentials`)
+  if (!res.ok) throw new Error(`Settings service returned ${res.status} fetching MQTT credentials (create a "${CLIENT_NAME}" service client in Settings)`)
   const s = await res.json()
   if (!s.host || !s.username || !s.password) throw new Error('MQTT broker credentials not configured in settings')
   return { host: s.host, port: s.port || 1883, username: s.username, password: s.password }
diff --git a/docker-compose.yml b/docker-compose.yml
index 2becb4d..bf707b7 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -8,10 +8,6 @@ services:
       - CENTRAL_AUTH_SECRET=${CENTRAL_AUTH_SECRET}
       - SETTINGS_URL=${SETTINGS_URL}
       - SETTINGS_SECRET=${SETTINGS_SECRET}
-      - MQTT_BROKER_HOST=${MQTT_BROKER_HOST:-10.10.10.104}
-      - MQTT_BROKER_PORT=${MQTT_BROKER_PORT:-1883}
-      - MQTT_USERNAME=${MQTT_USERNAME:-}
-      - MQTT_PASSWORD=${MQTT_PASSWORD:-}
       - APP_SLUG=hvac
       - OFFICE_IP_CHECK=${OFFICE_IP_CHECK:-disabled}
       - NEWBOOK_LOCATION_ID=${NEWBOOK_LOCATION_ID:-}