diff --git a/admin/cmd/main.go b/admin/cmd/main.go
index 2e10114..693382f 100644
--- a/admin/cmd/main.go
+++ b/admin/cmd/main.go
@@ -40,7 +40,7 @@ func main() {
 		log.Println("warning: SMTP not configured; verification and licence emails will fail")
 	}
 
-	auth.InitRedis(cfg.RedisAddr)
+	auth.InitRedis(cfg.RedisAddr, cfg.RedisUsername, cfg.RedisPassword)
 	pingCtx, pingCancel := context.WithTimeout(context.Background(), 10*time.Second)
 	if err := auth.Ping(pingCtx); err != nil {
 		pingCancel()
diff --git a/admin/internal/auth/session.go b/admin/internal/auth/session.go
index 9c7184c..e75af95 100644
--- a/admin/internal/auth/session.go
+++ b/admin/internal/auth/session.go
@@ -30,7 +30,18 @@ type Session struct {
 
 var rdb *redis.Client
 
-func InitRedis(addr string) { rdb = redis.NewClient(&redis.Options{Addr: addr}) }
+// InitRedis connects the session store.
+//
+// Username and password may both be empty for an unauthenticated instance. For
+// a legacy `requirepass` Redis, pass the password with an empty username —
+// go-redis then sends AUTH with one argument instead of two.
+func InitRedis(addr, username, password string) {
+	rdb = redis.NewClient(&redis.Options{
+		Addr:     addr,
+		Username: username,
+		Password: password,
+	})
+}
 
 func Ping(ctx context.Context) error { return rdb.Ping(ctx).Err() }
 
diff --git a/admin/internal/config/config.go b/admin/internal/config/config.go
index 91d5043..16c7cef 100644
--- a/admin/internal/config/config.go
+++ b/admin/internal/config/config.go
@@ -18,6 +18,8 @@ type Config struct {
 	ControlMongoURI string
 	ControlDBName   string
 	RedisAddr       string
+	RedisUsername   string
+	RedisPassword   string
 	SigningKey      string
 	PublicURL       string
 	AllowedOrigins  []string
@@ -54,6 +56,11 @@ func Load() (Config, error) {
 		AdminMongoURI:   os.Getenv("ADMIN_MONGO_URI"),
 		ControlMongoURI: os.Getenv("CONTROL_MONGO_URI"),
 		RedisAddr:       os.Getenv("REDIS_ADDR"),
+		// Optional: an unauthenticated Redis needs neither. Redis 6+ ACL auth
+		// takes both; a legacy `requirepass` instance takes the password alone
+		// and must leave the username empty.
+		RedisUsername: os.Getenv("REDIS_USERNAME"),
+		RedisPassword: os.Getenv("REDIS_PASSWORD"),
 		SigningKey:      os.Getenv("LICENSE_SIGNING_KEY"),
 		PublicURL:       strings.TrimSuffix(os.Getenv("PUBLIC_URL"), "/"),
 		TrustProxy:      strings.EqualFold(os.Getenv("TRUST_PROXY"), "true"),
diff --git a/deploy/docker-compose.site.yml b/deploy/docker-compose.site.yml
index 3548af3..31df76b 100644
--- a/deploy/docker-compose.site.yml
+++ b/deploy/docker-compose.site.yml
@@ -3,10 +3,9 @@ services:
         image: gitea.hostxtra.co.uk/mrhid6/vantage/site:latest
         restart: unless-stopped
         ports:
-            - 3001:3000
+            - 3002:3000
         depends_on:
             - sitesvc
-
     sitesvc:
         image: gitea.hostxtra.co.uk/mrhid6/vantage/sitesvc:latest
         restart: unless-stopped
@@ -15,21 +14,16 @@ services:
         environment:
             PORT: "8082"
             MONGO_URI: ${MONGO_URI:-}
-            PUBLIC_URL: ${SITE_PUBLIC_URL:-}
-            APP_LOGIN_URL: ${SITE_APP_LOGIN_URL:-}
+            PUBLIC_URL: ${PUBLIC_URL:-}
+            APP_LOGIN_URL: ${APP_LOGIN_URL:-}
             SITE_ORIGIN: ${SITE_ORIGIN:-}
             TRUST_PROXY: ${SITE_TRUST_PROXY:-false}
-            SMTP_HOST: ${SITE_SMTP_HOST:-}
-            SMTP_PORT: ${SITE_SMTP_PORT:-587}
-            SMTP_USERNAME: ${SITE_SMTP_USERNAME:-}
-            SMTP_PASSWORD: ${SITE_SMTP_PASSWORD:-}
-            SMTP_FROM: ${SITE_SMTP_FROM:-}
-            SMTP_TO: ${SITE_SMTP_TO:-support@hostxtra.co.uk}
-
-    # The licensing authority. LICENSE_SIGNING_KEY appears in exactly one
-    # service in exactly one compose file: here. It must never be added to
-    # `server`, and docker-compose.yml -- the self-hosted deployment -- must
-    # not mention admin at all.
+            SMTP_HOST: ${SMTP_HOST:-}
+            SMTP_PORT: ${SMTP_PORT:-587}
+            SMTP_USERNAME: ${SMTP_USERNAME:-}
+            SMTP_PASSWORD: ${SMTP_PASSWORD:-}
+            SMTP_FROM: ${SMTP_FROM:-}
+            SMTP_TO: ${SMTP_TO:-support@hostxtra.co.uk}
     admin:
         image: gitea.hostxtra.co.uk/mrhid6/vantage/admin:latest
         restart: unless-stopped
@@ -38,16 +32,17 @@ services:
         environment:
             PORT: "8083"
             ADMIN_MONGO_URI: ${ADMIN_MONGO_URI:-}
-            CONTROL_MONGO_URI: ${CONTROL_MONGO_URI:-}
-            REDIS_ADDR: redis:6379
+            CONTROL_MONGO_URI: ${MONGO_URI:-}
+            REDIS_ADDR: ${ADMIN_REDIS_ADDR:-10.10.10.2:6379}
+            REDIS_USERNAME: ${ADMIN_REDIS_USERNAME:-}
+            REDIS_PASSWORD: ${ADMIN_REDIS_PASSWORD:-}
             LICENSE_SIGNING_KEY: ${LICENSE_SIGNING_KEY:-}
             PUBLIC_URL: ${ADMIN_PUBLIC_URL:-}
             ADMIN_ORIGIN: ${ADMIN_ORIGIN:-}
-            TRUST_PROXY: ${ADMIN_TRUST_PROXY:-true}
-            SMTP_HOST: ${SITE_SMTP_HOST:-}
-            SMTP_PORT: ${SITE_SMTP_PORT:-587}
-            SMTP_USERNAME: ${SITE_SMTP_USERNAME:-}
-            SMTP_PASSWORD: ${SITE_SMTP_PASSWORD:-}
-            SMTP_FROM: ${SITE_SMTP_FROM:-}
-        depends_on:
-            - redis
+            TRUST_PROXY: ${TRUST_PROXY:-true}
+            SMTP_HOST: ${SMTP_HOST:-}
+            SMTP_PORT: ${SMTP_PORT:-587}
+            SMTP_USERNAME: ${SMTP_USERNAME:-}
+            SMTP_PASSWORD: ${SMTP_PASSWORD:-}
+            SMTP_FROM: ${SMTP_FROM:-}
+networks: {}