diff --git a/deploy/self-hosting/.env.example b/deploy/self-hosting/.env.example
index a0a307047..a0ea53a37 100644
--- a/deploy/self-hosting/.env.example
+++ b/deploy/self-hosting/.env.example
@@ -100,6 +100,12 @@ FLUXER_MEDIA_PROXY_UPLOAD_RELAY_SECRET_BASE64=CHANGE_ME
 FLUXER_ADMIN_SECRET_KEY_BASE=CHANGE_ME
 FLUXER_ADMIN_OAUTH_CLIENT_SECRET=CHANGE_ME
 
+# The token every service sends to NATS. The bundled NATS runs without
+# authentication, so this stays empty unless a Compose override points the stack
+# at an external NATS that requires a token. Compose forwards the name to every
+# container that connects.
+#FLUXER_NATS_AUTH_TOKEN=
+
 FLUXER_VAPID_PUBLIC_KEY=CHANGE_ME
 FLUXER_VAPID_PRIVATE_KEY=CHANGE_ME