diff --git a/.gitea/workflows/nightly.yml b/.gitea/workflows/nightly.yml
index 0764bc03..97643ee3 100644
--- a/.gitea/workflows/nightly.yml
+++ b/.gitea/workflows/nightly.yml
@@ -143,6 +143,16 @@ jobs:
           cp -r infra/observability /opt/familienarchiv/infra/
           cp docker-compose.observability.yml /opt/familienarchiv/
 
+      - name: Validate observability compose config
+        # Dry-run: resolves all variable substitutions from /opt/familienarchiv/.env
+        # and reports any missing required keys before containers start. Catches
+        # truncated passwords (missing $$ escaping), undefined variables, and YAML
+        # errors in config files updated by the previous step.
+        run: |
+          docker compose \
+            -f /opt/familienarchiv/docker-compose.observability.yml \
+            config --quiet
+
       - name: Start observability stack
         # Runs from /opt/familienarchiv/ so bind mounts resolve to stable
         # host paths that survive workspace wipes between nightly runs.