diff --git a/docs/cli-switch.mdx b/docs/cli-switch.mdx
new file mode 100644
index 0000000000..ac3f529348
--- /dev/null
+++ b/docs/cli-switch.mdx
@@ -0,0 +1,47 @@
+---
+title: "CLI switch command"
+sidebarTitle: "switch"
+description: "The `trigger.dev switch` command can be used to switch between profiles."
+tag: "v4"
+---
+
+import UpgradeToV4Note from "/snippets/upgrade-to-v4-note.mdx";
+import ProjectPathArg from "/snippets/cli-args-project-path.mdx";
+import CommonOptions from "/snippets/cli-options-common.mdx";
+import ProjectRefOption from "/snippets/cli-options-project-ref.mdx";
+import EnvFileOption from "/snippets/cli-options-env-file.mdx";
+import ConfigFileOption from "/snippets/cli-options-config-file.mdx";
+import SkipUpdateCheckOption from "/snippets/cli-options-skip-update-check.mdx";
+import BranchOption from "/snippets/cli-options-branch.mdx";
+
+<UpgradeToV4Note />
+
+Run the command like this:
+
+<CodeGroup>
+
+```bash npm
+npx trigger.dev@v4-beta switch [profile]
+```
+
+```bash pnpm
+pnpm dlx trigger.dev@v4-beta switch [profile]
+```
+
+```bash yarn
+yarn dlx trigger.dev@v4-beta switch [profile]
+```
+
+</CodeGroup>
+
+It will switch to the specified profile. If no profile is specified, it will list all available profiles and run interactively.
+
+## Arguments
+
+```
+npx trigger.dev@v4-beta switch [profile]
+```
+
+<ParamField body="Profile" type="[profile]">
+  The profile to switch to. If not specified, it will list all available profiles and run interactively.
+</ParamField>
diff --git a/docs/docs.json b/docs/docs.json
index 6eab50625a..fe5e2b766a 100644
--- a/docs/docs.json
+++ b/docs/docs.json
@@ -140,16 +140,17 @@
               {
                 "group": "Commands",
                 "pages": [
-                  "cli-login-commands",
-                  "cli-init-commands",
-                  "cli-dev-commands",
                   "cli-deploy-commands",
-                  "cli-promote-commands",
-                  "cli-preview-archive",
-                  "cli-whoami-commands",
-                  "cli-logout-commands",
+                  "cli-dev-commands",
+                  "cli-init-commands",
                   "cli-list-profiles-commands",
-                  "cli-update-commands"
+                  "cli-login-commands",
+                  "cli-logout-commands",
+                  "cli-preview-archive",
+                  "cli-promote-commands",
+                  "cli-switch",
+                  "cli-update-commands",
+                  "cli-whoami-commands"
                 ]
               }
             ]
diff --git a/docs/self-hosting/docker.mdx b/docs/self-hosting/docker.mdx
index 8261653675..e6ac5758fd 100644
--- a/docs/self-hosting/docker.mdx
+++ b/docs/self-hosting/docker.mdx
@@ -14,14 +14,15 @@ Should the burden ever get too much, we'd be happy to see you on [Trigger.dev cl
 ## What's new?
 
 Goodbye v3, hello v4! We made quite a few changes:
-- **Much simpler setup.** Provider + coordinator = supervisor. No more startup scripts. Just `docker compose up`.
+- **Much simpler setup.** The provider and coordinator are now combined into a single supervisor. No more startup scripts, just `docker compose up`.
+- **Automatic container cleanup.** The supervisor will automatically clean up containers that are no longer needed.
 - **Support for multiple worker machines.** This is a big one, and we're very excited about it! You can now scale your workers horizontally as needed.
 - **Resource limits enforced by default.** This means that tasks will be limited to the total CPU and RAM of the machine preset, preventing noisy neighbours.
 - **No direct Docker socket access.** The compose file now comes with [Docker Socket Proxy](https://github.com/Tecnativa/docker-socket-proxy) by default. Yes, you want this.
 - **No host networking.** All containers are now running with network isolation, using only the network access they need.
-- **No checkpoint support.** This was only ever an experimental self-hosting feature and not recommended. It caused a bunch of issues. We decided to focus on the core features instead.
+- **No checkpoint support.** This was only ever experimental when self-hosting and not recommended. It caused a bunch of issues. We decided to focus on the core features instead.
 - **Built-in container registry and object storage.** You can now deploy and execute tasks without needing third party services for this.
-- **Improved CLI commands.** You don't need any additional flags to deploy anymore, and there's a new `switch` command to easily switch between profiles.
+- **Improved CLI commands.** You don't need any additional flags to deploy anymore, and there's a new command to easily `switch` between profiles.
 - **Whitelisting for GitHub OAuth.** Any whitelisted email addresses will now also apply to sign ins via GitHub, unlike v3 where they only applied to magic links.
 
 ## Requirements
@@ -39,14 +40,14 @@ To run the webapp and worker components, you will need:
 
 ### Webapp
 
-This will host the webapp, postgres, redis, and related services.
+This machine will host the webapp, postgres, redis, and related services.
 
 - 2+ vCPU
 - 4+ GB RAM
 
 ### Worker
 
-This will host the supervisor and all of the runs.
+This machine will host the supervisor and all of the runs.
 
 - 2+ vCPU
 - 4+ GB RAM
@@ -86,26 +87,30 @@ cd webapp
 docker compose up -d
 ```
 
-4. Optional: Add traefik as a reverse proxy
+4. Configure the webapp using the [environment variables](/self-hosting/env/webapp) in your `.env` file, then apply the changes:
 
 ```bash
-docker compose -f ../docker-compose.traefik.yml up -d
+docker compose up -d
 ```
 
-5. Configure the webapp as needed using the [environment variables](/self-hosting/env/webapp) and apply the changes:
+5. You should now be able to access the webapp at `http://localhost:8030`. When logging in, check the container logs for the magic link:
 
 ```bash
-docker compose up -d
+docker compose logs -f webapp
 ```
 
-6. You should now be able to access the webapp at `http://localhost:8030`. When logging in, check the container logs for the magic link: `docker compose logs -f webapp`
-
-7. Optional: To initialize a new project, run the following command:
+6. (optional) To initialize a new project, run the following command:
 
 ```bash
 npx trigger.dev@v4-beta init -p <project-ref> -a http://localhost:8030
 ```
 
+{/* 7. Bonus: Add traefik as a reverse proxy
+
+```bash
+docker compose -f docker-compose.yml -f ../docker-compose.traefik.yml up -d
+``` */}
+
 ### Worker
 
 1. Clone the repository
@@ -128,13 +133,15 @@ cd worker
 docker compose up -d
 ```
 
-Configure the supervisor as needed using the [environment variables](/self-hosting/env/supervisor) and apply the changes:
+4. Configure the supervisor using the [environment variables](/self-hosting/env/supervisor) in your `.env` file, including the [worker token](#worker-token).
+
+5. Apply the changes:
 
 ```bash
 docker compose up -d
 ```
 
-Repeat as needed for additional workers.
+6. Repeat as needed for additional workers.
 
 ### Combined
 
@@ -142,36 +149,109 @@ If you want to run the webapp and worker on the same machine, just replace the `
 
 ```bash
 # Run this from the /hosting/docker directory
-docker compose -f docker-compose.webapp.yml -f docker-compose.worker.yml up -d
+docker compose -f webapp/docker-compose.yml -f worker/docker-compose.yml up -d
 ```
 
-And optionally add traefik as a reverse proxy:
+{/* And optionally add traefik as a reverse proxy:
 
 ```bash
 # Run this from the /hosting/docker directory
-docker compose -f docker-compose.webapp.yml -f docker-compose.worker.yml -f docker-compose.traefik.yml up -d
+docker compose -f webapp/docker-compose.yml -f worker/docker-compose.yml -f docker-compose.traefik.yml up -d
+``` */}
+
+## Worker token
+
+When running the combined stack, worker bootstrap is handled automatically. When running the webapp and worker separately, you will need to manually set the worker token.
+
+On the first run, the webapp will generate a worker token and store it in a shared volume. It will also print the token to the console. It should look something like this:
+
+```bash
+==========================
+Trigger.dev Bootstrap - Worker Token
+
+WARNING: This will only be shown once. Save it now!
+
+Worker group:
+bootstrap
+
+Token:
+tr_wgt_fgfAEjsTmvl4lowBLTbP7Xo563UlnVa206mr9uW6
+
+If using docker compose, set:
+TRIGGER_WORKER_TOKEN=tr_wgt_fgfAEjsTmvl4lowBLTbP7Xo563UlnVa206mr9uW6
+
+Or, if using a file:
+TRIGGER_WORKER_TOKEN=file:///home/node/shared/worker_token
+
+==========================
 ```
 
-## Version locking
+You can then uncomment and set the `TRIGGER_WORKER_TOKEN` environment variable in your `.env` file.
 
-There are several reasons to lock the version of your Docker images:
-- **Backwards compatibility.** We try our best to maintain compatibility with older CLI versions, but it's not always possible. If you don't want to update your CLI, you can lock your Docker images to that specific version.
-- **Ensuring full feature support.** Sometimes, new CLI releases will also require new or updated platform features. Running unlocked images can make any issues difficult to debug. Using a specific tag can help here as well.
+Don't forget to restart the worker container for the changes to take effect:
 
-By default, the images will point at the latest versioned release via the `v4-beta` tag. You can override this by specifying a different tag in your `.env` file. For example:
+```bash
+# Run this from the /hosting/docker/worker directory
+docker compose down
+docker compose up -d
+```
+
+## Registry setup
+
+The registry is used to store and pull deployment images. When testing the stack locally, the defaults should work out of the box.
+
+When deploying to production, you will need to set the correct URL and generate secure credentials for the registry.
+
+### Default settings
+
+The default settings for the registry are:
+
+- Registry: `localhost:5000`
+- Username: `registry-user`
+- Password: `very-secure-indeed`
+
+You should change these before deploying to production, especially the password. You can find more information about how to do this in the official [registry docs](https://github.com/distribution/distribution/blob/735c161b53e7faf81a21ba94c55ac9edee081cd9/docs/deploying.md#native-basic-auth).
+
+### Logging in
+
+When self-hosting, builds run locally. You will have to login to the registry on every machine that runs the `deploy` command. You should only have to do this once:
 
 ```bash
-TRIGGER_IMAGE_TAG=v4.0.0-v4-beta.21
+docker login -u <username> <registry>
 ```
 
+This will prompt for the password. Afterwards, the deploy command should work as expected.
+
+## Object storage
+
+This is mainly used for large payloads and outputs. There are a few simple steps to follow to get started.
+
+### Default settings
+
+The default settings for the object storage are:
+
+- Endpoint: `http://localhost:9000`
+- Username: `admin`
+- Password: `very-safe-password`
+
+You should change these before deploying to production, especially the password.
+
+### Setup
+
+1. Login to the dashboard: `http://localhost:9001`
+
+2. Create a bucket named `packets`.
+
+3. For production, you will want to set up a dedicated user and not use the root credentials above.
+
 ## Authentication
 
+The specific set of variables required will depend on your choice of email transport or alternative login methods like GitHub OAuth.
+
 ### Magic link
 
 By default, magic link auth is the only login option. If the `EMAIL_TRANSPORT` env var is not set, the magic links will be logged by the webapp container and not sent via email.
 
-The specific set of variables required will depend on your choice of email transport.
-
 #### Resend
 
 ```bash
@@ -228,23 +308,32 @@ All email addresses can sign up and log in this way. If you would like to restri
 WHITELISTED_EMAILS="authorized@yahoo\.com|authorized@gmail\.com"
 ```
 
-This will apply to all auth methods.
+This will apply to all auth methods including magic link and GitHub OAuth.
 
-## Troubleshooting
+## Version locking
 
-- **Deployment fails at the push step.** The machine running `deploy` needs registry access:
+There are several reasons to lock the version of your Docker images:
+- **Backwards compatibility.** We try our best to maintain compatibility with older CLI versions, but it's not always possible. If you don't want to update your CLI, you can lock your Docker images to that specific version.
+- **Ensuring full feature support.** Sometimes, new CLI releases will also require new or updated platform features. Running unlocked images can make any issues difficult to debug. Using a specific tag can help here as well.
+
+By default, the images will point at the latest versioned release via the `v4-beta` tag. You can override this by specifying a different tag in your `.env` file. For example:
 
 ```bash
-docker login -u <username> <registry>
-# this should now succeed
-npx trigger.dev@v4-beta deploy
+TRIGGER_IMAGE_TAG=v4.0.0-v4-beta.21
 ```
 
-This needs to match the registry credentials. Defaults for the `localhost:5000` registry are `registry-user` and `very-safe-password`. You should change these.
+## Troubleshooting
+
+- **Deployment fails at the push step.** The machine running `deploy` needs registry access. See the [registry setup](#registry-setup) section for more details.
 
 - **Magic links don't arrive.** The webapp container needs to be able to send emails. You probably need to set up an email transport. See the [authentication](#authentication) section for more details.
 
-You should check the logs of the webapp container to see the magic link: `docker logs -f trigger-webapp-1`
+  You should check the logs of the webapp container to see the magic link:
+
+  ```bash
+  # Run this from the /hosting/docker/webapp directory
+  docker compose logs -f webapp
+  ```
 
 ## CLI usage
 
@@ -260,7 +349,7 @@ npx trigger.dev@v4-beta login -a http://trigger.example.com
 
 Once you've logged in, you shouldn't have to specify the URL again with other commands.
 
-#### Profiles
+### Profiles
 
 You can specify a profile when logging in. This allows you to easily use the CLI with multiple instances of Trigger.dev. For example:
 
@@ -299,7 +388,7 @@ npx trigger.dev@v4-beta switch
 npx trigger.dev@v4-beta switch self-hosted
 ```
 
-#### Whoami
+### Whoami
 
 It can be useful to check you are logged into the correct instance. Running this will also show the API URL:
 
@@ -307,7 +396,7 @@ It can be useful to check you are logged into the correct instance. Running this
 npx trigger.dev@v4-beta whoami
 ```
 
-### CI / GitHub Actions
+## CI / GitHub Actions
 
 When running the CLI in a CI environment, your login profiles won't be available. Instead, you can use the `TRIGGER_API_URL` and `TRIGGER_ACCESS_TOKEN` environment 
 variables to point at your self-hosted instance and authenticate.
diff --git a/docs/self-hosting/env/webapp.mdx b/docs/self-hosting/env/webapp.mdx
index 825183100e..6a4b7bbada 100644
--- a/docs/self-hosting/env/webapp.mdx
+++ b/docs/self-hosting/env/webapp.mdx
@@ -126,7 +126,7 @@ mode: "wide"
 | `RUN_ENGINE_RATE_LIMIT_LIMITER_LOGS_ENABLED`   | No       | 0                     | Run engine rate limit limiter logs.                                                                       |
 | **Misc**                                       |          |                       |                                                                                                           |
 | `TRIGGER_TELEMETRY_DISABLED`                   | No       | —                     | Disable telemetry.                                                                                        |
-| `NODE_MAX_OLD_SPACE_SIZE`                      | No       | —                     | Maximum memory allocation for Node.js heap (e.g. "4096" for 4GB).                                         |
+| `NODE_MAX_OLD_SPACE_SIZE`                      | No       | 8192                  | Maximum memory allocation for Node.js heap in MiB (e.g. "4096" for 4GB).                                  |
 | `OPENAI_API_KEY`                               | No       | —                     | OpenAI API key.                                                                                           |
 | `MACHINE_PRESETS_OVERRIDE_PATH`                | No       | —                     | Path to machine presets override file. See [machine overrides](/self-hosting/overview#machine-overrides). |
 | `APP_ENV`                                      | No       | `NODE_ENV`            | App environment. Used for things like the title tag.                                                      |
diff --git a/hosting/docker/.env.example b/hosting/docker/.env.example
index cc35b9e6e1..946bd3d311 100644
--- a/hosting/docker/.env.example
+++ b/hosting/docker/.env.example
@@ -1,3 +1,8 @@
+# Trigger.dev self-hosting environment variables
+# - These are the default values for the self-hosting stack
+# - You should change them to suit your needs, especially the secrets
+# - See the docs for more information: https://trigger.dev/docs/self-hosting/overview
+
 # Secrets
 # - Do NOT use these defaults in production
 # - Generate your own by running `openssl rand -hex 16` for each secret
@@ -6,66 +11,100 @@ MAGIC_LINK_SECRET=44da78b7bbb0dfe709cf38931d25dcdd
 ENCRYPTION_KEY=f686147ab967943ebbe9ed3b496e465a
 MANAGED_WORKER_SECRET=447c29678f9eaf289e9c4b70d3dd8a7f
 
-# Trigger image tags
-# - You should lock these to a specific version in production
-# - For example: SUPERVISOR_IMAGE_TAG=v4-beta.21
-SUPERVISOR_IMAGE_TAG=v4-beta
-WEBAPP_IMAGE_TAG=v4-beta
+# Worker token
+# - This is the token for the worker to connect to the webapp
+# - When running the combined stack, this is set automatically during bootstrap
+# - For the split setup, you will have to set this manually. The token is available in the webapp logs but will only be shown once.
+# - See the docs for more information: https://trigger.dev/docs/self-hosting/docker
+# TRIGGER_WORKER_TOKEN=
+
+# Postgres
+# - Do NOT use these defaults in production
+# - Especially if you decide to expose the database to the internet
+# POSTGRES_USER=postgres
+POSTGRES_PASSWORD=unsafe-postgres-pw
+# POSTGRES_DB=postgres
+DATABASE_URL=postgresql://postgres:unsafe-postgres-pw@postgres:5432/main?schema=public&sslmode=disable
+DIRECT_URL=postgresql://postgres:unsafe-postgres-pw@postgres:5432/main?schema=public&sslmode=disable
+
+# Trigger image tag
+# - This is the version of the webapp and worker images to use, they should be locked to a specific version in production
+# - For example: TRIGGER_IMAGE_TAG=v4-beta.21
+TRIGGER_IMAGE_TAG=v4-beta
 
 # Webapp
+# - These should generally be set to the same value
+# - In production, these should be set to the public URL of your webapp, e.g. https://trigger.example.com
 APP_ORIGIN=http://localhost:8030
 LOGIN_ORIGIN=http://localhost:8030
-# WEBAPP_PUBLISH_IP=0.0.0.0
+API_ORIGIN=http://localhost:8030
+# You may need to set this when testing locally or when using the combined setup
+# API_ORIGIN=http://webapp:3000
+
+# Webapp - memory management
+# - This sets the maximum memory allocation for Node.js heap in MiB (e.g. "4096" for 4GB)
+# - It should be set according to your total webapp machine's memory or any container limits you have set
+# - Setting this too high or low WILL cause crashes, inefficient memory utilization and high CPU usage
+# - You should allow for some memory overhead, we suggest at least 20%, for example:
+#   - 2GB machine: NODE_MAX_OLD_SPACE_SIZE=1600
+#   - 4GB machine: NODE_MAX_OLD_SPACE_SIZE=3200
+#   - 6GB machine: NODE_MAX_OLD_SPACE_SIZE=4800
+#   - 8GB machine: NODE_MAX_OLD_SPACE_SIZE=6400
+# NODE_MAX_OLD_SPACE_SIZE=8192
+
+# Docker Registry
+# - When testing locally, the default values should be fine
+# - When deploying to production, you will have to change these, especially the password and URL
+# - See the docs for more information: https://trigger.dev/docs/self-hosting/docker
+DOCKER_REGISTRY_URL=localhost:5000
+DOCKER_REGISTRY_USERNAME=registry-user
+DOCKER_REGISTRY_PASSWORD=very-secure-indeed
 
 # Object store
-# - You need to set these up via the Minio dashboard first: http://localhost:9001
-# - See Minio section for login details
-# OBJECT_STORE_ACCESS_KEY_ID=
-# OBJECT_STORE_SECRET_ACCESS_KEY=
+# - You need to log into the Minio dashboard and create a bucket called "packets" 
+# - See the docs for more information: https://trigger.dev/docs/self-hosting/docker
+OBJECT_STORE_ACCESS_KEY_ID=admin
+OBJECT_STORE_SECRET_ACCESS_KEY=very-safe-password
+# You will have to uncomment and configure this for production
+# OBJECT_STORE_BASE_URL=http://localhost:9000
+# Credentials to access the Minio dashboard at http://localhost:9001
+# - You should change these credentials and not use them for the `OBJECT_STORE_` env vars above
+# - Instead, setup a non-root user with access the "packets" bucket
+# MINIO_ROOT_USER=admin
+# MINIO_ROOT_PASSWORD=very-safe-password
 
-# Postgres
-# - Do NOT use these defaults in production
-# - Especially if you decide to expose the database to the internet
-POSTGRES_USER=postgres
-POSTGRES_PASSWORD=postgres
-POSTGRES_DB=postgres
-# POSTGRES_PUBLISH_IP=127.0.0.1
+# Other image tags
+# - These are the versions of the other images to use
+# - You should lock these to a specific version in production
 # POSTGRES_IMAGE_TAG=14
-
-# Redis
-# REDIS_PUBLISH_IP=127.0.0.1
 # REDIS_IMAGE_TAG=7
-
-# ElectricSQL
-# ELECTRIC_IMAGE_TAG=
-
-# Clickhouse
+# ELECTRIC_IMAGE_TAG=1.0.13
 # CLICKHOUSE_IMAGE_TAG=latest
-# CLICKHOUSE_PUBLISH_IP=127.0.0.1
-
-# Registry
 # REGISTRY_IMAGE_TAG=2
-# REGISTRY_PUBLISH_IP=127.0.0.1
-
-# Minio
 # MINIO_IMAGE_TAG=latest
-# MINIO_PUBLISH_IP=127.0.0.1
-# MINIO_ROOT_USER=admin
-# MINIO_ROOT_PASSWORD=very-safe-password
+# DOCKER_PROXY_IMAGE_TAG=latest
+# TRAEFIK_IMAGE_TAG=v3.4
 
-# Docker Registry
-# DEPLOY_REGISTRY_HOST=localhost:5000
-# DOCKER_REGISTRY_URL=
-# DOCKER_REGISTRY_USERNAME=
-# DOCKER_REGISTRY_PASSWORD=
+# Publish IPs
+# - These are the IPs to publish the services to
+# - Setting to 127.0.0.1 makes the service only accessible locally
+# - When deploying to production, you will have to change these, depending on your setup
+# WEBAPP_PUBLISH_IP=0.0.0.0
+# POSTGRES_PUBLISH_IP=127.0.0.1
+# REDIS_PUBLISH_IP=127.0.0.1
+# ELECTRIC_PUBLISH_IP=127.0.0.1
+# CLICKHOUSE_PUBLISH_IP=127.0.0.1
+# REGISTRY_PUBLISH_IP=127.0.0.1
+# MINIO_PUBLISH_IP=127.0.0.1
 
-# Docker Socket Proxy
-# DOCKER_PROXY_IMAGE_TAG=latest
+# Restart policy
+# - Applies to all services, adjust as needed
+# RESTART_POLICY=unless-stopped
 
 # Traefik
+# - Reverse proxy settings only serve as an example and require further configuration
+# - See the partial overrides in docker-compose.traefik.yml for more details
 # TRAEFIK_ENTRYPOINT=websecure
-# TRAEFIK_IMAGE_TAG=latest
-# RESTART_POLICY=
 # TRAEFIK_HTTP_PUBLISH_IP=0.0.0.0
 # TRAEFIK_HTTPS_PUBLISH_IP=0.0.0.0
 # TRAEFIK_DASHBOARD_PUBLISH_IP=127.0.0.1
\ No newline at end of file
diff --git a/hosting/docker/webapp/docker-compose.yml b/hosting/docker/webapp/docker-compose.yml
index 4a2e2ffdce..b458f84f44 100644
--- a/hosting/docker/webapp/docker-compose.yml
+++ b/hosting/docker/webapp/docker-compose.yml
@@ -2,7 +2,7 @@ name: trigger
 
 services:
   webapp:
-    image: ghcr.io/triggerdotdev/trigger.dev:${WEBAPP_IMAGE_TAG:-v4-beta}
+    image: ghcr.io/triggerdotdev/trigger.dev:${TRIGGER_IMAGE_TAG:-v4-beta}
     restart: ${RESTART_POLICY:-unless-stopped}
     ports:
       - ${WEBAPP_PUBLISH_IP:-0.0.0.0}:8030:3000
@@ -27,9 +27,10 @@ services:
     environment:
       APP_ORIGIN: ${APP_ORIGIN:-http://localhost:8030}
       LOGIN_ORIGIN: ${LOGIN_ORIGIN:-http://localhost:8030}
+      API_ORIGIN: ${API_ORIGIN:-http://localhost:8030}
       ELECTRIC_ORIGIN: http://electric:3000
-      DATABASE_URL: postgresql://postgres:postgres@postgres:5432/main?schema=public&sslmode=disable
-      DIRECT_URL: postgresql://postgres:postgres@postgres:5432/main?schema=public&sslmode=disable
+      DATABASE_URL: ${DATABASE_URL:-postgresql://postgres:postgres@postgres:5432/main?schema=public&sslmode=disable}
+      DIRECT_URL: ${DIRECT_URL:-postgresql://postgres:postgres@postgres:5432/main?schema=public&sslmode=disable}
       SESSION_SECRET: ${SESSION_SECRET}
       MAGIC_LINK_SECRET: ${MAGIC_LINK_SECRET}
       ENCRYPTION_KEY: ${ENCRYPTION_KEY}
@@ -39,8 +40,8 @@ services:
       REDIS_TLS_DISABLED: true
       APP_LOG_LEVEL: info
       DEV_OTEL_EXPORTER_OTLP_ENDPOINT: http://localhost:8030/otel
-      DEPLOY_REGISTRY_HOST: ${DEPLOY_REGISTRY_HOST:-localhost:5000}
-      OBJECT_STORE_BASE_URL: http://minio:9000
+      DEPLOY_REGISTRY_HOST: ${DOCKER_REGISTRY_URL:-localhost:5000}
+      OBJECT_STORE_BASE_URL: ${OBJECT_STORE_BASE_URL:-http://minio:9000}
       OBJECT_STORE_ACCESS_KEY_ID: ${OBJECT_STORE_ACCESS_KEY_ID}
       OBJECT_STORE_SECRET_ACCESS_KEY: ${OBJECT_STORE_SECRET_ACCESS_KEY}
       GRACEFUL_SHUTDOWN_TIMEOUT: 1000
diff --git a/hosting/docker/worker/docker-compose.yml b/hosting/docker/worker/docker-compose.yml
index 7e0cc9f91a..0ccf8544e9 100644
--- a/hosting/docker/worker/docker-compose.yml
+++ b/hosting/docker/worker/docker-compose.yml
@@ -2,13 +2,14 @@ name: trigger
 
 services:
   supervisor:
-    image: ghcr.io/triggerdotdev/supervisor:${SUPERVISOR_IMAGE_TAG:-v4-beta}
+    image: ghcr.io/triggerdotdev/supervisor:${TRIGGER_IMAGE_TAG:-v4-beta}
     restart: ${RESTART_POLICY:-unless-stopped}
     depends_on:
       - docker-proxy
     networks:
       - supervisor
       - docker-proxy
+      - webapp
     volumes:
       - shared:/home/node/shared
     # Only needed for bootstrap
@@ -18,6 +19,7 @@ services:
     environment:
       # This needs to match the token of the worker group you want to connect to
       # TRIGGER_WORKER_TOKEN: ${TRIGGER_WORKER_TOKEN}
+      # Use the bootstrap token created by the webapp
       TRIGGER_WORKER_TOKEN: file:///home/node/shared/worker_token
       MANAGED_WORKER_SECRET: ${MANAGED_WORKER_SECRET}
       # Point this at the webapp in prod
@@ -72,3 +74,5 @@ networks:
     name: docker-proxy
   supervisor:
     name: supervisor
+  webapp:
+    name: webapp