diff --git a/docker/.env b/docker/.env
index 0ecf69d6..9bfd439a 100644
--- a/docker/.env
+++ b/docker/.env
@@ -24,6 +24,9 @@ ALICE_REST_PORT=8081
 BOB_REST_PORT=8082
 CAROL_REST_PORT=8083
 
-# RTL
+# RTL. Must not be one of RTL's blacklisted weak passwords
+# ('password', 'changeme', 'moneyprintergobrrr') or RTL forces a password change
+# on every login and parks you on the auth settings screen. Set in
+# rtl/RTL-Config.regtest.json as multiPass; this is only used for messages.
 RTL_PORT=3000
-RTL_PASSWORD=password
+RTL_PASSWORD=rtldev
diff --git a/docker/README.md b/docker/README.md
index 48533f9e..3f35c750 100644
--- a/docker/README.md
+++ b/docker/README.md
@@ -28,7 +28,7 @@ docker compose up -d          # bitcoind, alice, bob, carol, rtl
 ./scripts/seed.sh             # fund, connect, open channels, make payments
 ```
 
-Then open <http://localhost:3000> — password `password`. All three nodes appear in
+Then open <http://localhost:3000> — password `rtldev`. All three nodes appear in
 the node switcher.
 
 Tear down, discarding all state:
diff --git a/docker/rtl/RTL-Config.regtest.json b/docker/rtl/RTL-Config.regtest.json
index 0be5d6f7..927280a4 100644
--- a/docker/rtl/RTL-Config.regtest.json
+++ b/docker/rtl/RTL-Config.regtest.json
@@ -1,5 +1,5 @@
 {
-  "multiPass": "password",
+  "multiPass": "rtldev",
   "port": "3000",
   "defaultNodeIndex": 1,
   "dbDirectoryPath": "/RTL/database",