diff --git a/docker-compose.yml b/docker-compose.yml
index 01db454..f9ec475 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -44,7 +44,7 @@ services:
       - WORDPRESS_DB_USER=${DB_USER}
       - WORDPRESS_DB_PASSWORD=${DB_PASSWORD}
       - WORDPRESS_TABLE_PREFIX=wbox_
-      - WORDPRESS_CONFIG_EXTRA=
+      - WORDPRESS_CONFIG_EXTRA=require_once '/usr/src/websitebox-config.php';
       - AGE_GATE_ENABLED=${AGE_GATE_ENABLED}
       - AGE_GATE_MIN_AGE=${AGE_GATE_MIN_AGE}
       - BACKUP_RETENTION_DAYS=${BACKUP_RETENTION_DAYS}
diff --git a/wordpress/Dockerfile b/wordpress/Dockerfile
index 7d47827..a2f8ef9 100644
--- a/wordpress/Dockerfile
+++ b/wordpress/Dockerfile
@@ -22,8 +22,10 @@ RUN echo "pm.status_path = /status" >> /usr/local/etc/php-fpm.d/zz-docker.conf
 # Copy PHP upload config
 COPY uploads.ini /usr/local/etc/php/conf.d/uploads.ini
 
-# Copy wp-config template
-COPY wp-config-docker.php /usr/src/wordpress/wp-config-docker.php
+# Copy extra WordPress config (loaded via WORDPRESS_CONFIG_EXTRA)
+# Do NOT overwrite /usr/src/wordpress/wp-config-docker.php — that's the official
+# template that defines DB constants, auth keys, table prefix, etc.
+COPY wp-config-docker.php /usr/src/websitebox-config.php
 
 # Copy child theme and mu-plugins
 COPY wp-content/themes/websitebox/ /usr/src/websitebox-theme/
@@ -33,9 +35,12 @@ COPY wp-content/mu-plugins/ /usr/src/websitebox-mu-plugins/
 COPY entrypoint.sh /usr/local/bin/websitebox-entrypoint.sh
 RUN chmod +x /usr/local/bin/websitebox-entrypoint.sh
 
-# Create Wordfence-compatible .user.ini
+# Create Wordfence-compatible .user.ini and stub WAF file
+# The stub prevents PHP fatal errors before Wordfence is installed;
+# Wordfence will overwrite it with the real WAF during plugin activation.
 RUN echo "; Wordfence PHP settings" > /usr/src/wordpress/.user.ini && \
-    echo "auto_prepend_file = /var/www/html/wordfence-waf.php" >> /usr/src/wordpress/.user.ini
+    echo "auto_prepend_file = /var/www/html/wordfence-waf.php" >> /usr/src/wordpress/.user.ini && \
+    echo "<?php // Wordfence WAF placeholder - replaced during setup" > /usr/src/wordpress/wordfence-waf.php
 
 ENTRYPOINT ["websitebox-entrypoint.sh"]
 CMD ["php-fpm"]