diff --git a/.env.dist b/.env.dist
new file mode 100644
index 0000000..db08e40
--- /dev/null
+++ b/.env.dist
@@ -0,0 +1,2 @@
+DEBUG=True
+SECRET_KEY=1234567890
diff --git a/.gitignore b/.gitignore
index b7729ff..e05d2ad 100644
--- a/.gitignore
+++ b/.gitignore
@@ -9,6 +9,9 @@ wheels/
 # Virtual environments
 .venv
 
+# Environment files
+.env
+
 # Node modules (only for types definitions)
 node_modules/
 
diff --git a/dronewars/settings.py b/dronewars/settings.py
index edbe66a..4ffd728 100644
--- a/dronewars/settings.py
+++ b/dronewars/settings.py
@@ -10,23 +10,31 @@ For the full list of settings and their values, see
 https://docs.djangoproject.com/en/6.0/ref/settings/
 """
 
+import os
 from datetime import timedelta
 from pathlib import Path
 
+from dotenv import load_dotenv
+
 # Build paths inside the project like this: BASE_DIR / 'subdir'.
 BASE_DIR = Path(__file__).resolve().parent.parent
 
+load_dotenv(BASE_DIR / ".env")
+
 
 # Quick-start development settings - unsuitable for production
 # See https://docs.djangoproject.com/en/6.0/howto/deployment/checklist/
 
 # SECURITY WARNING: keep the secret key used in production secret!
-SECRET_KEY = "django-insecure-nows$x_3#k9x7j09f*o4xmx#p6zeb%ak+#ew2pc01yx2bm+hwq"
+SECRET_KEY = os.getenv(
+    "SECRET_KEY",
+    "django-insecure-nows$x_3#k9x7j09f*o4xmx#p6zeb%ak+#ew2pc01yx2bm+hwq",
+)
 
 # SECURITY WARNING: don't run with debug turned on in production!
-DEBUG = True
+DEBUG = os.getenv("DEBUG", "False").strip().lower() in {"1", "true", "yes", "on"}
 
-ALLOWED_HOSTS = []
+ALLOWED_HOSTS = ["127.0.0.1", "localhost"]
 
 
 # Application definition
diff --git a/pyproject.toml b/pyproject.toml
index 4e70321..b25f1b5 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -11,6 +11,7 @@ dependencies = [
     "djangorestframework-simplejwt>=5.5.0",
     "ipython>=9.10.0",
     "pydantic>=2.12.5",
+    "python-dotenv>=1.2.1",
     "uvicorn>=0.40.0",
     "whitenoise>=6.11.0",
 ]
diff --git a/requirements.txt b/requirements.txt
index 47e1319..c885adc 100644
--- a/requirements.txt
+++ b/requirements.txt
@@ -22,6 +22,7 @@ pydantic==2.12.5
 pydantic-core==2.41.5
 pygments==2.19.2
 pyjwt==2.11.0
+python-dotenv==1.2.1
 sqlparse==0.5.5
 stack-data==0.6.3
 traitlets==5.14.3
diff --git a/uv.lock b/uv.lock
index 47d648a..f5db5dd 100644
--- a/uv.lock
+++ b/uv.lock
@@ -119,6 +119,7 @@ dependencies = [
     { name = "djangorestframework-simplejwt" },
     { name = "ipython" },
     { name = "pydantic" },
+    { name = "python-dotenv" },
     { name = "uvicorn" },
     { name = "whitenoise" },
 ]
@@ -131,6 +132,7 @@ requires-dist = [
     { name = "djangorestframework-simplejwt", specifier = ">=5.5.0" },
     { name = "ipython", specifier = ">=9.10.0" },
     { name = "pydantic", specifier = ">=2.12.5" },
+    { name = "python-dotenv", specifier = ">=1.2.1" },
     { name = "uvicorn", specifier = ">=0.40.0" },
     { name = "whitenoise", specifier = ">=6.11.0" },
 ]
@@ -347,6 +349,15 @@ wheels = [
     { url = "https://files.pythonhosted.org/packages/6f/01/c26ce75ba460d5cd503da9e13b21a33804d38c2165dec7b716d06b13010c/pyjwt-2.11.0-py3-none-any.whl", hash = "sha256:94a6bde30eb5c8e04fee991062b534071fd1439ef58d2adc9ccb823e7bcd0469", size = 28224, upload-time = "2026-01-30T19:59:54.539Z" },
 ]
 
+[[package]]
+name = "python-dotenv"
+version = "1.2.1"
+source = { registry = "https://pypi.org/simple" }
+sdist = { url = "https://files.pythonhosted.org/packages/f0/26/19cadc79a718c5edbec86fd4919a6b6d3f681039a2f6d66d14be94e75fb9/python_dotenv-1.2.1.tar.gz", hash = "sha256:42667e897e16ab0d66954af0e60a9caa94f0fd4ecf3aaf6d2d260eec1aa36ad6", size = 44221, upload-time = "2025-10-26T15:12:10.434Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/14/1b/a298b06749107c305e1fe0f814c6c74aea7b2f1e10989cb30f544a1b3253/python_dotenv-1.2.1-py3-none-any.whl", hash = "sha256:b81ee9561e9ca4004139c6cbba3a238c32b03e4894671e181b671e8cb8425d61", size = 21230, upload-time = "2025-10-26T15:12:09.109Z" },
+]
+
 [[package]]
 name = "sqlparse"
 version = "0.5.5"