diff --git a/docker-compose.yml b/docker-compose.yml
index 30daad3..66fe6a8 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -401,15 +401,18 @@ services:
   # ─── Watchtower (auto-redeploy custom services on new images) ────────────────
   # Only watches services labelled com.centurylinklabs.watchtower.enable=true.
   # Third-party infra images (minio, pocketbase, meilisearch, etc.) are excluded.
+  # doppler binary is mounted from the host so watchtower fetches fresh secrets
+  # on every start (notification URL, credentials) without baking them in.
   watchtower:
     image: containrrr/watchtower:latest
     restart: unless-stopped
+    entrypoint: ["doppler", "run", "--"]
+    command: ["/watchtower", "--label-enable", "--interval", "300", "--cleanup"]
     volumes:
       - /var/run/docker.sock:/var/run/docker.sock
-    command: --label-enable --interval 300 --cleanup
+      - /usr/local/bin/doppler:/usr/local/bin/doppler:ro
     environment:
-      WATCHTOWER_NOTIFICATIONS: "${WATCHTOWER_NOTIFICATIONS}"
-      WATCHTOWER_NOTIFICATION_URL: "${WATCHTOWER_NOTIFICATION_URL}"
+      DOPPLER_TOKEN: "${DOPPLER_TOKEN}"
       DOCKER_API_VERSION: "1.44"
 
 volumes:
diff --git a/homelab/docker-compose.yml b/homelab/docker-compose.yml
index 7b323ad..c70d3c7 100644
--- a/homelab/docker-compose.yml
+++ b/homelab/docker-compose.yml
@@ -443,15 +443,18 @@ services:
   # ── Watchtower ──────────────────────────────────────────────────────────────
   # Auto-updates runner image when CI pushes a new tag.
   # Only watches services with the watchtower label.
+  # doppler binary is mounted from the host so watchtower fetches fresh secrets
+  # on every start (notification URL, credentials) without baking them in.
   watchtower:
     image: containrrr/watchtower:latest
     restart: unless-stopped
+    entrypoint: ["doppler", "run", "--"]
+    command: ["/watchtower", "--label-enable", "--interval", "300", "--cleanup"]
     volumes:
       - /var/run/docker.sock:/var/run/docker.sock
-    command: --label-enable --interval 300 --cleanup
+      - /usr/local/bin/doppler:/usr/local/bin/doppler:ro
     environment:
-      WATCHTOWER_NOTIFICATIONS: "${WATCHTOWER_NOTIFICATIONS}"
-      WATCHTOWER_NOTIFICATION_URL: "${WATCHTOWER_NOTIFICATION_URL}"
+      DOPPLER_TOKEN: "${DOPPLER_TOKEN}"
       DOCKER_API_VERSION: "1.44"
 
 volumes: