diff --git a/.env.backup-before-rollback b/.env.backup-before-rollback
new file mode 100644
index 0000000..f649749
--- /dev/null
+++ b/.env.backup-before-rollback
@@ -0,0 +1,34 @@
+# Local .env for docker compose ${REDIS_PASSWORD} interpolation.
+# DO NOT COMMIT (already in .gitignore). На прод-боксе оператор создаёт свой через `cp .env.example .env`.
+
+VAULT_ADDR=
+VAULT_ROLE_ID=
+VAULT_SECRET_ID=
+VAULT_MOUNT_POINT=dev-secrets
+VAULT_SECRET_PATH=database
+VAULT_JWT_KID_PATH=jwt/kid
+VAULT_JWT_KIDS_PREFIX=jwt/kids
+VAULT_CSRF_PATH=csrf
+VAULT_CRYPTO_KEY_PATH=crypto/master
+
+JWT_ALGORITHM=RS256
+JWT_ISSUER=bitok
+JWT_AUDIENCE=elcsa
+
+API_PORT=3001
+LOG_LEVEL=INFO
+
+CORS_ORIGINS=*
+CORS_ALLOW_CREDENTIALS=false
+
+REDIS_HOST=keydb
+REDIS_PORT=6379
+REDIS_PASSWORD=0O7klMYUvwwR19UORSzEtsRn9kUPnDyfkJ9GDH2yMERYV0vRCU
+REDIS_DB=0
+
+# Price oracle (CoinGecko free tier — без ключа работает).
+COINGECKO_API_KEY=
+
+# Outbound proxy для swap + bridge endpoints.
+# Если задан — Jupiter/Relay/RPC calls идут через proxy. Read-only direct.
+OUTBOUND_PROXY_URL=http://37.220.84.34:3128