diff --git a/config/config.exs b/config/config.exs
index fc14f41..f0de43b 100644
--- a/config/config.exs
+++ b/config/config.exs
@@ -25,13 +25,11 @@ config :aprsme, Aprsme.PromEx,
 
 # Configures the endpoint
 config :aprsme, AprsmeWeb.Endpoint,
-  url: [host: "localhost"],
   render_errors: [
     formats: [html: AprsmeWeb.ErrorHTML, json: AprsmeWeb.ErrorJSON],
     layout: false
   ],
-  pubsub_server: Aprsme.PubSub,
-  live_view: [signing_salt: "dev-signing-salt-local-only"]
+  pubsub_server: Aprsme.PubSub
 
 # Configure Gettext with supported locales from AprsmeWeb.Gettext module
 config :aprsme, AprsmeWeb.Gettext,
diff --git a/config/dev.exs b/config/dev.exs
index 63c49fb..be65107 100644
--- a/config/dev.exs
+++ b/config/dev.exs
@@ -41,7 +41,9 @@ config :aprsme, AprsmeWeb.Endpoint,
   # Binding to loopback ipv4 address prevents access from other machines.
   # Change to `ip: {0, 0, 0, 0}` to allow access from other machines.
   adapter: Bandit.PhoenixAdapter,
+  url: [host: "localhost"],
   http: [ip: {127, 0, 0, 1}, port: 4000],
+  live_view: [signing_salt: "dev-signing-salt-local-only"],
   check_origin: false,
   code_reloader: true,
   debug_errors: true,
diff --git a/config/test.exs b/config/test.exs
index 841cdb5..52c6b90 100644
--- a/config/test.exs
+++ b/config/test.exs
@@ -36,7 +36,9 @@ config :aprsme, Aprsme.Repo,
 # you can enable the server option below.
 config :aprsme, AprsmeWeb.Endpoint,
   adapter: Bandit.PhoenixAdapter,
+  url: [host: "localhost"],
   http: [ip: {127, 0, 0, 1}, port: 4002],
+  live_view: [signing_salt: "test-signing-salt-local-only"],
   secret_key_base: "IV9+ENaw9i8xjReRk4sULRvRgsmFVTGQwQGGrf4G+Q/SFMeHBCNWRlPXQ2YvT36R",
   server: false
 
diff --git a/k8s/deployment.yaml b/k8s/deployment.yaml
index d50a70e..fef8819 100644
--- a/k8s/deployment.yaml
+++ b/k8s/deployment.yaml
@@ -78,6 +78,8 @@ spec:
                 secretKeyRef:
                   name: aprs-secrets
                   key: SECRET_KEY_BASE
+            - name: RELEASE_VALIDATE_COMPILE_ENV
+              value: "false"
           envFrom:
             - secretRef:
                 name: aprs-db
diff --git a/k8s/networkpolicy-egress.yaml b/k8s/networkpolicy-egress.yaml
index 17b128d..72ce559 100644
--- a/k8s/networkpolicy-egress.yaml
+++ b/k8s/networkpolicy-egress.yaml
@@ -43,16 +43,12 @@ spec:
       ports:
         - port: 443
           protocol: TCP
-    # Database egress (PostgreSQL — if in-cluster, restrict to DB pod)
-    # Update the podSelector if your PostgreSQL runs in-cluster with a specific label.
-    # If your DB is external, this is covered by the 0.0.0.0/0 catch-all above on port 5432.
+    # Database egress (PgBouncer + direct PostgreSQL)
     - to:
         - ipBlock:
-            cidr: 0.0.0.0/0
-            except:
-              - 10.0.0.0/8
-              - 172.16.0.0/12
-              - 192.168.0.0/16
+            cidr: 10.0.19.30/32
       ports:
+        - port: 6432
+          protocol: TCP
         - port: 5432
           protocol: TCP
diff --git a/mix.exs b/mix.exs
index 6551808..dc33421 100644
--- a/mix.exs
+++ b/mix.exs
@@ -42,7 +42,8 @@ defmodule Aprsme.MixProject do
       ],
       releases: [
         aprsme: [
-          steps: [:assemble]
+          steps: [:assemble],
+          validate_compile_env: false
         ]
       ]
     ]