diff --git a/.gitignore b/.gitignore
index 1009968..550b00c 100644
--- a/.gitignore
+++ b/.gitignore
@@ -9,6 +9,7 @@ lerna-debug.log*
 node_modules
 dist
 dist-ssr
+.env
 *.local
 server/prisma/dev.db
 test-results/
diff --git a/server/.env b/server/.env
deleted file mode 100644
index 6b56485..0000000
--- a/server/.env
+++ /dev/null
@@ -1,6 +0,0 @@
-PORT=3002
-DATABASE_URL="file:D:/Coding/gymflow/server/prisma/dev.db"
-JWT_SECRET="supersecretkey_change_in_production"
-API_KEY="AIzaSyCiu9gD-BcsbyIT1qpPIJrKvz_2sVyZE9A"
-ADMIN_EMAIL=admin@gymflow.ai
-ADMIN_PASSWORD=admin123
diff --git a/server/package-lock.json b/server/package-lock.json
index a5d0347..4db6a61 100644
--- a/server/package-lock.json
+++ b/server/package-lock.json
@@ -26,6 +26,7 @@
                 "@types/express": "*",
                 "@types/jsonwebtoken": "*",
                 "@types/node": "*",
+                "dotenv-cli": "^11.0.0",
                 "nodemon": "*",
                 "prisma": "^7.1.0",
                 "ts-node": "*",
@@ -1174,6 +1175,51 @@
                 "url": "https://dotenvx.com"
             }
         },
+        "node_modules/dotenv-cli": {
+            "version": "11.0.0",
+            "resolved": "https://registry.npmjs.org/dotenv-cli/-/dotenv-cli-11.0.0.tgz",
+            "integrity": "sha512-r5pA8idbk7GFWuHEU7trSTflWcdBpQEK+Aw17UrSHjS6CReuhrrPcyC3zcQBPQvhArRHnBo/h6eLH1fkCvNlww==",
+            "dev": true,
+            "license": "MIT",
+            "dependencies": {
+                "cross-spawn": "^7.0.6",
+                "dotenv": "^17.1.0",
+                "dotenv-expand": "^12.0.0",
+                "minimist": "^1.2.6"
+            },
+            "bin": {
+                "dotenv": "cli.js"
+            }
+        },
+        "node_modules/dotenv-expand": {
+            "version": "12.0.3",
+            "resolved": "https://registry.npmjs.org/dotenv-expand/-/dotenv-expand-12.0.3.tgz",
+            "integrity": "sha512-uc47g4b+4k/M/SeaW1y4OApx+mtLWl92l5LMPP0GNXctZqELk+YGgOPIIC5elYmUH4OuoK3JLhuRUYegeySiFA==",
+            "dev": true,
+            "license": "BSD-2-Clause",
+            "dependencies": {
+                "dotenv": "^16.4.5"
+            },
+            "engines": {
+                "node": ">=12"
+            },
+            "funding": {
+                "url": "https://dotenvx.com"
+            }
+        },
+        "node_modules/dotenv-expand/node_modules/dotenv": {
+            "version": "16.6.1",
+            "resolved": "https://registry.npmjs.org/dotenv/-/dotenv-16.6.1.tgz",
+            "integrity": "sha512-uBq4egWHTcTt33a72vpSG0z3HnPuIl6NqYcTrKEg2azoEyl2hpW0zqlxysq2pK9HlDIHyHyakeYaYnSAwd8bow==",
+            "dev": true,
+            "license": "BSD-2-Clause",
+            "engines": {
+                "node": ">=12"
+            },
+            "funding": {
+                "url": "https://dotenvx.com"
+            }
+        },
         "node_modules/dunder-proto": {
             "version": "1.0.1",
             "resolved": "https://registry.npmjs.org/dunder-proto/-/dunder-proto-1.0.1.tgz",
diff --git a/server/package.json b/server/package.json
index b12e0f3..93196ff 100644
--- a/server/package.json
+++ b/server/package.json
@@ -29,6 +29,7 @@
         "@types/express": "*",
         "@types/jsonwebtoken": "*",
         "@types/node": "*",
+        "dotenv-cli": "^11.0.0",
         "nodemon": "*",
         "prisma": "^7.1.0",
         "ts-node": "*",
diff --git a/server/src/index.ts b/server/src/index.ts
index b513f08..4f48ef0 100644
--- a/server/src/index.ts
+++ b/server/src/index.ts
@@ -1,4 +1,8 @@
-import 'dotenv/config';
+import dotenv from 'dotenv';
+import path from 'path';
+
+// Load env from project root
+dotenv.config({ path: path.join(__dirname, '../../.env') });
 import express from 'express';
 import cors from 'cors';
 import authRoutes from './routes/auth';
@@ -12,7 +16,6 @@ import bcrypt from 'bcryptjs';
 import { PrismaClient } from '@prisma/client';
 import { PrismaBetterSqlite3 } from '@prisma/adapter-better-sqlite3';
 import BetterSqlite3 from 'better-sqlite3';
-import path from 'path';
 
 const app = express();
 
@@ -20,8 +23,13 @@ const app = express();
 // Ensure a default admin user exists on startup
 // -------------------------------------------------------------------
 async function ensureAdminUser() {
-    const adminEmail = process.env.ADMIN_EMAIL || 'admin@gymflow.ai';
-    const adminPassword = process.env.ADMIN_PASSWORD || 'admin123';
+    const adminEmail = process.env.ADMIN_EMAIL;
+    const adminPassword = process.env.ADMIN_PASSWORD;
+
+    if (!adminEmail || !adminPassword) {
+        console.warn('⚠️  ADMIN_EMAIL or ADMIN_PASSWORD not set in .env. Skipping default admin creation.');
+        return;
+    }
 
     // Use the singleton prisma client
     const prisma = (await import('./lib/prisma')).default;