diff --git a/.env.example b/.env.example
index 6ba5dcf9..5b928337 100644
--- a/.env.example
+++ b/.env.example
@@ -23,6 +23,7 @@ PORT_MAILPIT_SMTP=1025
 
 # OCR Training — secret token required to call /train and /segtrain on the OCR service.
 # Also set in the backend so it can pass the token through. Must not be empty in production.
+# Generate with: python3 -c "import secrets; print(secrets.token_hex(32))"
 OCR_TRAINING_TOKEN=change-me-in-production
 
 # Production SMTP — uncomment and fill in to send real emails instead of catching them
diff --git a/docker-compose.yml b/docker-compose.yml
index 35660e0f..0637d417 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -87,7 +87,7 @@ services:
     memswap_limit: 12g
     volumes:
       - ocr_models:/app/models
-      - ocr_cache:/root/.cache
+      - ocr_cache:/root/.cache  # Hugging Face / ketos model download cache — prevents re-downloads on container recreate
     environment:
       KRAKEN_MODEL_PATH: /app/models/german_kurrent.mlmodel
       TRAINING_TOKEN: "${OCR_TRAINING_TOKEN:-}"
@@ -102,7 +102,7 @@ services:
       interval: 10s
       timeout: 5s
       retries: 12
-      start_period: 60s
+      start_period: 120s
 
   # --- Backend: Spring Boot ---
   backend: