diff --git a/README.md b/README.md
index e8d4625c..10fab87e 100644
--- a/README.md
+++ b/README.md
@@ -149,9 +149,14 @@ cd TimeTracker
 cp env.example .env
 # Edit .env and set a strong SECRET_KEY (python -c "import secrets; print(secrets.token_hex(32))")
 
-# Start with Docker Compose
-docker-compose -f docker-compose.example.yml up -d
+# Start with Docker Compose (HTTPS via nginx)
+docker-compose up -d
+
+# Access at https://localhost (self-signed cert)
 
+# Prefer plain HTTP on port 8080?
+# Use the example compose that publishes the app directly:
+# docker-compose -f docker-compose.example.yml up -d
 # Access at http://localhost:8080
 ```
 
diff --git a/docker-compose.yml b/docker-compose.yml
index 1d9e485a..39ad28e6 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -66,7 +66,7 @@ services:
       - CSRF_COOKIE_SAMESITE=${CSRF_COOKIE_SAMESITE:-Lax}
       - CSRF_COOKIE_NAME=${CSRF_COOKIE_NAME:-XSRF-TOKEN}
       - PREFERRED_URL_SCHEME=${PREFERRED_URL_SCHEME:-https}
-      - WTF_CSRF_TRUSTED_ORIGINS=$(WTF_CSRF_TRUSTED_ORIGINS:-https://localhost)
+      - WTF_CSRF_TRUSTED_ORIGINS=${WTF_CSRF_TRUSTED_ORIGINS:-https://localhost}
       - DATABASE_URL=postgresql+psycopg2://timetracker:timetracker@db:5432/timetracker
       - LOG_FILE=/app/logs/timetracker.log
       # Analytics & Monitoring (optional)
diff --git a/docs/GETTING_STARTED.md b/docs/GETTING_STARTED.md
index fc2bcdbc..b3bb359c 100644
--- a/docs/GETTING_STARTED.md
+++ b/docs/GETTING_STARTED.md
@@ -29,7 +29,13 @@ cd TimeTracker
 docker-compose up -d
 
 # 3. Access the application
-# Open your browser to: http://localhost:8080
+# Open your browser to: https://localhost
+# (Self‑signed certificate; your browser will show a warning the first time.)
+
+# Prefer plain HTTP on port 8080 instead?
+# Use the example compose that publishes the app directly:
+# docker-compose -f docker-compose.example.yml up -d
+# Then open: http://localhost:8080
 ```
 
 **That's it!** TimeTracker is now running with PostgreSQL.
diff --git a/scripts/generate-certs.sh b/scripts/generate-certs.sh
index 86ef4895..783621d9 100644
--- a/scripts/generate-certs.sh
+++ b/scripts/generate-certs.sh
@@ -36,7 +36,14 @@ echo ""
 # Install openssl if not present
 if ! command -v openssl >/dev/null 2>&1; then
     echo "Installing OpenSSL..."
-    apk add --no-cache openssl
+    if command -v apk >/dev/null 2>&1; then
+        apk add --no-cache openssl
+    elif command -v apt-get >/dev/null 2>&1; then
+        apt-get update && apt-get install -y --no-install-recommends openssl && rm -rf /var/lib/apt/lists/*
+    else
+        echo "⚠️ Could not detect package manager to install openssl. Please install it manually."
+        exit 1
+    fi
 fi
 
 # Detect IP address (try to get container host IP)