diff --git a/vav_pipeline/config/prod.exs b/vav_pipeline/config/prod.exs
index 3f923b81..4f063bde 100644
--- a/vav_pipeline/config/prod.exs
+++ b/vav_pipeline/config/prod.exs
@@ -2,16 +2,17 @@ import Config
 
 config :logger, level: :info
 
-# Production paths — Construction spec §4.4
+# Production defaults — Construction spec §4.4
+# Env-var overrides are in runtime.exs (evaluated at boot, not compile)
 config :vav_pipeline,
   l1_mount_point: "/mnt/torah",
   manna_provision_file: "/var/lib/shorashim/manna/today.json",
   cycle_boundary_check_interval_ms: 60_000,
-  shema_context_cache_ttl_ms: 0
+  shema_context_cache_ttl_ms: 0,
+  http_port: 4000
 
 # L3 — Production PostgreSQL
-# Construction §3.8: l3_database_url from environment variable
-# The kohen/DBA sets the connection string via DATABASE_URL
+# DATABASE_URL is set at runtime via runtime.exs
+# These are compile-time defaults only
 config :vav_pipeline, VavPipeline.Repo,
-  url: System.get_env("DATABASE_URL"),
   pool_size: 20
diff --git a/vav_pipeline/config/runtime.exs b/vav_pipeline/config/runtime.exs
new file mode 100644
index 00000000..f58fd9d1
--- /dev/null
+++ b/vav_pipeline/config/runtime.exs
@@ -0,0 +1,30 @@
+import Config
+
+# Runtime configuration — read from environment variables at boot.
+# This file is evaluated at runtime, not compile time.
+# Required for OTP releases where env vars aren't known at build time.
+
+if config_env() == :prod do
+  # L3 — PostgreSQL connection
+  # The kohen sets DATABASE_URL in the K8s secret
+  database_url =
+    System.get_env("DATABASE_URL") ||
+      raise """
+      DATABASE_URL not set.
+      The kohen must set the DATABASE_URL in shorashim-secrets.
+      Format: ecto://user:password@host:port/database?sslmode=require
+      """
+
+  config :vav_pipeline, VavPipeline.Repo,
+    url: database_url,
+    pool_size: String.to_integer(System.get_env("POOL_SIZE") || "20")
+
+  # L1 mount point — overridable via env
+  config :vav_pipeline,
+    l1_mount_point: System.get_env("L1_MOUNT_POINT") || "/mnt/torah",
+    manna_provision_file:
+      System.get_env("MANNA_PROVISION_FILE") || "/var/lib/shorashim/manna/today.json",
+    talmudic_socket_path:
+      System.get_env("TALMUDIC_SOCKET_PATH") || "/tmp/shorashim/talmudic.sock",
+    http_port: String.to_integer(System.get_env("HTTP_PORT") || "4000")
+end