diff --git a/deploy/compose.production.yml b/deploy/compose.production.yml
index 563f150..153b8b6 100644
--- a/deploy/compose.production.yml
+++ b/deploy/compose.production.yml
@@ -3,7 +3,7 @@ name: shd-build-production
 services:
   app:
     image: ${SHD_IMAGE:-shd-build-production:local}
-    restart: unless-stopped
+    restart: always
     init: true
     environment:
       INFISICAL_PROJECT_ID: 2ee94b27-e599-4194-9797-3372d42e53f6
@@ -42,7 +42,7 @@ services:
 
   scheduler:
     image: ${SHD_IMAGE:-shd-build-production:local}
-    restart: unless-stopped
+    restart: always
     init: true
     command:
       - scheduler
diff --git a/deploy/runtime-start.test.ts b/deploy/runtime-start.test.ts
index ee9fc76..d38b0ae 100644
--- a/deploy/runtime-start.test.ts
+++ b/deploy/runtime-start.test.ts
@@ -142,6 +142,10 @@ describe('container runtime startup', () => {
         { key: 'APP_ORIGIN', value: 'https://exported.invalid' },
         { key: 'DISCORD_CLIENT_ID', value: 'exported-discord-client' },
         { key: 'DISCORD_CLIENT_SECRET', value: 'exported-discord-secret' },
+        {
+          key: 'MFA_TOTP_ENCRYPTION_KEYS',
+          value: 'totp-encryption-keyring',
+        },
       ]),
       writeExport(sharedExport, [
         { key: 'SCHEDULER_TOKEN', value: schedulerToken },
@@ -220,6 +224,7 @@ describe('container runtime startup', () => {
       APP_ORIGIN: 'https://stage.shd.build',
       DISCORD_CLIENT_ID: 'exported-discord-client',
       DISCORD_CLIENT_SECRET: 'exported-discord-secret',
+      MFA_TOTP_ENCRYPTION_KEYS: 'totp-encryption-keyring',
       ORIGIN: 'https://stage.shd.build',
       PASSKEY_RP_ID: 'shd.build',
       SCHEDULER_TOKEN: schedulerToken,
diff --git a/scripts/runtime-launcher.mjs b/scripts/runtime-launcher.mjs
index e96c7dd..5627e7c 100644
--- a/scripts/runtime-launcher.mjs
+++ b/scripts/runtime-launcher.mjs
@@ -14,6 +14,7 @@ const APP_SECRET_NAMES = new Set([
   'OPENAI_MECHANIC_MODEL',
   'OPENAI_MECHANIC_REASONING_EFFORT',
   'OPENAI_MODERATION_API_KEY',
+  'MFA_TOTP_ENCRYPTION_KEYS',
   'ORIGIN',
   'PASSKEY_RP_ID',
   'REMOVE_BG_API_KEY',