diff --git a/docker-compose.debug.yaml b/docker-compose.debug.yaml
index 361ce1e..3fe20eb 100644
--- a/docker-compose.debug.yaml
+++ b/docker-compose.debug.yaml
@@ -34,14 +34,22 @@ services:
       - go-mod-cache:/go/pkg/mod
       - go-build-cache:/root/.cache/go-build
       - /app/src/tmp # Exclude Air's tmp dir from syncing
+      # mTLS identity for the auth edge: the certs Maestro issued for the dev
+      # fleet (devboot, DCNTRLIZED_DEV=true) at the shared-module default paths,
+      # so the authproxy client authenticates to the mTLS auth hub.
+      - ${DCNTRLIZED_DATA_DIR:-$HOME/.dcntrlized}/pki/ca.crt:/dcntrlized/pki/ca.crt:ro
+      - ${DCNTRLIZED_DATA_DIR:-$HOME/.dcntrlized}/pki/keepnote/tls.crt:/dcntrlized/pki/tls.crt:ro
+      - ${DCNTRLIZED_DATA_DIR:-$HOME/.dcntrlized}/pki/keepnote/tls.key:/dcntrlized/pki/tls.key:ro
 
     working_dir: /app/
 
     # Environment variables for the application
     environment:
-      - DEV_MODE=true
-      # Security theme M2 §2: dev escape hatch — keep the listener plaintext
-      # so the RN client (direct mode) and hot reload work without certs.
+      # DCNTRLIZED_DEV is the single dev selector (registry/auth URLs).
+      - DCNTRLIZED_DEV=true
+      # Security theme M2 §2: keep THIS listener plaintext so the RN client
+      # (direct mode) and hot reload work without certs. The auth proxy edge
+      # is still mTLS (mounted identity above).
       - INSECURE_INTERNAL=1
       # Application configuration
       # - PORT=8080
diff --git a/src/go.mod b/src/go.mod
index 1958668..6f09cdd 100644
--- a/src/go.mod
+++ b/src/go.mod
@@ -3,7 +3,7 @@ module git.dcntrlized.org/Dcntrlized/KeepNote
 go 1.26.5
 
 require (
-	git.dcntrlized.org/dcntrlized/dcntrlized-auth v0.1.1
+	git.dcntrlized.org/dcntrlized/dcntrlized-auth v0.1.2
 	github.com/google/uuid v1.6.0
 	github.com/jackc/pgx/v5 v5.10.0
 )
diff --git a/src/go.sum b/src/go.sum
index c17521b..92a8ee5 100644
--- a/src/go.sum
+++ b/src/go.sum
@@ -1,5 +1,5 @@
-git.dcntrlized.org/dcntrlized/dcntrlized-auth v0.1.1 h1:+uftpnwZL08rgGT6aS55EVM4BgEt4rVnPq4CwnhGQhI=
-git.dcntrlized.org/dcntrlized/dcntrlized-auth v0.1.1/go.mod h1:1ECTUA+Voaxhajld2XBZL2bHd+GYabFMEcx62CQ52M4=
+git.dcntrlized.org/dcntrlized/dcntrlized-auth v0.1.2 h1:1rU/15q81FL9D+VavBtEqPpnIleam37EvA+VoI/SNOs=
+git.dcntrlized.org/dcntrlized/dcntrlized-auth v0.1.2/go.mod h1:1ECTUA+Voaxhajld2XBZL2bHd+GYabFMEcx62CQ52M4=
 github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
 github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=