diff --git a/.env.example b/.env.example
index cc39cc6..6e22182 100644
--- a/.env.example
+++ b/.env.example
@@ -20,6 +20,12 @@ PRICE_UPDATE_INTERVAL_MINUTES=60
 # Max pagination pages to fetch when counting posts (default: 5 = up to 200 posts)
 MAX_PAGES_PER_HASHTAG=5
 
+# Initial admin user — only used by `npm run db:seed`, not the running app.
+# Pass these at seed time: docker exec -e ADMIN_USERNAME=x -e ADMIN_PASSWORD=y <container> npm run db:seed
+# If omitted, defaults to admin / changeme123 (change immediately after first login).
+# ADMIN_USERNAME=admin
+# ADMIN_PASSWORD=changeme123
+
 # Postgres (used by postgres container in prod-compose.yml)
 POSTGRES_DB=hashex
 POSTGRES_USER=hashex
diff --git a/prod-compose.yml b/prod-compose.yml
index c47a65a..1ef09a5 100644
--- a/prod-compose.yml
+++ b/prod-compose.yml
@@ -4,7 +4,7 @@ services:
     # Run migrations then start the web server
     command: sh -c "npx prisma db push --accept-data-loss && npm start"
     ports:
-      - "3000:3000"
+      - "12131:3000"
     environment:
       DATABASE_URL: "${DATABASE_URL}"
       NEXTAUTH_SECRET: "${NEXTAUTH_SECRET}"
diff --git a/src/app/api/auth/register/route.ts b/src/app/api/auth/register/route.ts
index 75a81d3..c64542e 100644
--- a/src/app/api/auth/register/route.ts
+++ b/src/app/api/auth/register/route.ts
@@ -3,7 +3,7 @@ import bcrypt from 'bcryptjs'
 import { prisma } from '@/lib/prisma'
 
 // Simple username validation — alphanumeric + underscores, 3-20 chars
-const USERNAME_RE = /^[a-z0-9_]{3,20}$/
+const USERNAME_RE = /^[a-z0-9_]{3,20}$/ // validated after toLowerCase
 
 export async function POST(req: NextRequest) {
   const body = await req.json().catch(() => null)
diff --git a/src/app/auth/signup/page.tsx b/src/app/auth/signup/page.tsx
index d9a737e..2563577 100644
--- a/src/app/auth/signup/page.tsx
+++ b/src/app/auth/signup/page.tsx
@@ -82,7 +82,7 @@ export default function SignUpPage() {
                 type="text"
                 value={username}
                 onChange={(e) => setUsername(e.target.value)}
-                pattern="^[a-z0-9_]{3,20}$"
+                pattern="^[a-zA-Z0-9_]{3,20}$"
                 title="3–20 characters: letters, numbers, underscores"
                 className="w-full bg-surface border border-surface-border rounded-lg px-3 py-2 text-sm focus:outline-none focus:ring-2 focus:ring-indigo-500"
                 placeholder="yourname"