diff --git a/.gitea/workflows/ci-cd.yaml b/.gitea/workflows/ci-cd.yaml
index fa2f503..ff67248 100644
--- a/.gitea/workflows/ci-cd.yaml
+++ b/.gitea/workflows/ci-cd.yaml
@@ -44,6 +44,14 @@ jobs:
           chmod 600 ~/.ssh/key
           ssh-keyscan -H ${{ secrets.DEPLOY_HOST }} >> ~/.ssh/known_hosts
 
-          ssh -i ~/.ssh/key \
-            ${{ secrets.DEPLOY_USER }}@${{ secrets.DEPLOY_HOST }} \
-            "cd ~/programs/botinator && docker compose pull && docker compose up -d"
+          HOST=${{ secrets.DEPLOY_USER }}@${{ secrets.DEPLOY_HOST }}
+          DIR=~/programs/botinator
+
+          # Ship the compose file and Lavalink config to the server. .env and
+          # catchphrases.txt live on the server and are intentionally not copied.
+          ssh -i ~/.ssh/key $HOST "mkdir -p $DIR/lavalink"
+          scp -i ~/.ssh/key docker-compose.yaml $HOST:'~/programs/botinator/docker-compose.yaml'
+          scp -i ~/.ssh/key lavalink/application.yml $HOST:'~/programs/botinator/lavalink/application.yml'
+
+          ssh -i ~/.ssh/key $HOST \
+            "cd $DIR && docker compose pull && docker compose up -d"
diff --git a/docker-compose.yaml b/docker-compose.yaml
index 2dbf6c8..3d82ab2 100644
--- a/docker-compose.yaml
+++ b/docker-compose.yaml
@@ -14,16 +14,24 @@ services:
       - .env
     environment:
       - LAVALINK_URI=ws://lavalink:2333
-    # Catchphrases are supplied at deploy time
+    # Catchphrases and the AR-meter user lists are supplied at deploy time,
+    # not baked into the image.
     volumes:
       - ./catchphrases.txt:/app/catchphrases.txt:ro
+      - ./always100.txt:/app/always100.txt:ro
+      - ./always90.txt:/app/always90.txt:ro
 
   lavalink:
     image: ghcr.io/lavalink-devs/lavalink:4
     container_name: lavalink
     restart: unless-stopped
+    env_file:
+      - .env
     environment:
       - _JAVA_OPTIONS=-Xmx1G
+      # Lavalink reads this for lavalink.server.password in application.yml.
+      # Keep it equal to LAVALINK_PASSWORD (what the bot uses to connect).
+      - LAVALINK_SERVER_PASSWORD=${LAVALINK_PASSWORD}
     volumes:
       - ./lavalink/application.yml:/opt/Lavalink/application.yml:ro
       - ./lavalink/plugins/:/opt/Lavalink/plugins/
diff --git a/lavalink/application.yml b/lavalink/application.yml
index 26016fc..4f69427 100644
--- a/lavalink/application.yml
+++ b/lavalink/application.yml
@@ -11,7 +11,9 @@ lavalink:
     - dependency: "dev.lavalink.youtube:youtube-plugin:1.18.1"
       snapshot: false
   server:
-    password: "youshallnotpass"
+    # Sourced from the LAVALINK_SERVER_PASSWORD env var (set by docker-compose
+    # from LAVALINK_PASSWORD in .env). Required — the server won't start without it.
+    password: "${LAVALINK_SERVER_PASSWORD}"
     sources:
       youtube: false      # handled by the plugin below, not the core source
       bandcamp: true
diff --git a/src/main/java/dev/ksan/botinator/Main.java b/src/main/java/dev/ksan/botinator/Main.java
index 9fa3243..8307866 100644
--- a/src/main/java/dev/ksan/botinator/Main.java
+++ b/src/main/java/dev/ksan/botinator/Main.java
@@ -34,13 +34,20 @@ public class Main extends ListenerAdapter {
             System.exit(1);
         }
 
+        String lavalinkPassword = System.getenv("LAVALINK_PASSWORD");
+        if (lavalinkPassword == null || lavalinkPassword.isBlank()) {
+            System.err.println("ERROR: environment variable LAVALINK_PASSWORD is not set. "
+                    + "Set it to your Lavalink server password (see .env) and try again.");
+            System.exit(1);
+        }
+
         // Lavalink client must be created before JDA so we can plug in the voice
         // interceptor. Its node points at a running Lavalink v4 server.
         LavalinkClient lavalink = new LavalinkClient(Helpers.getUserIdFromToken(token));
         lavalink.addNode(new NodeOptions.Builder()
                 .setName("main")
                 .setServerUri(getenv("LAVALINK_URI", "ws://localhost:2333"))
-                .setPassword(getenv("LAVALINK_PASSWORD", "youshallnotpass"))
+                .setPassword(lavalinkPassword)
                 .build());
 
         MusicManager musicManager = new MusicManager(lavalink);