diff --git a/charts/currents/templates/director/deployment.yaml b/charts/currents/templates/director/deployment.yaml
index a3834c0..c31b328 100644
--- a/charts/currents/templates/director/deployment.yaml
+++ b/charts/currents/templates/director/deployment.yaml
@@ -56,15 +56,13 @@ spec:
           {{- end }}
           {{- include "currents.connectionConfigEnv" . | nindent 12 }}
           {{- include "currents.URLConfigEnv" . | nindent 12 }}
-          {{- if .Values.currents.apiInternalToken.secretName }}
             - name: API_URL
               value: http://{{ include "currents.server.fullname" . }}/api/v1
             - name: API_SECRET
               valueFrom:
                 secretKeyRef:
-                  name: {{ .Values.currents.apiInternalToken.secretName }}
+                  name: {{ required "currents.apiInternalToken.secretName is required: the director authenticates to the server with this token" .Values.currents.apiInternalToken.secretName }}
                   key: {{ .Values.currents.apiInternalToken.key }}
-          {{- end }}
           {{- with (concat .Values.global.env .Values.director.env) }}
             {{- toYaml . | nindent 12 }}
           {{- end }}
diff --git a/charts/currents/templates/server/deployment.yaml b/charts/currents/templates/server/deployment.yaml
index 51606c1..10a334f 100644
--- a/charts/currents/templates/server/deployment.yaml
+++ b/charts/currents/templates/server/deployment.yaml
@@ -60,33 +60,27 @@ spec:
               value: "true"
             - name: ON_PREM_EMAIL
               value: {{ tpl .Values.currents.rootUser.email . }}
-          {{- if .Values.currents.rootUser.password.secretName }}
             - name: ON_PREM_PASSWORD
               valueFrom:
                 secretKeyRef:
-                  name: {{ .Values.currents.rootUser.password.secretName }}
+                  name: {{ required "currents.rootUser.password.secretName is required: it sets the root admin's password for the first sign-in" .Values.currents.rootUser.password.secretName }}
                   key: {{ .Values.currents.rootUser.password.key }}
-          {{- end }}
           {{- include "currents.connectionConfigEnv" . | nindent 12 }}
           {{- include "currents.URLConfigEnv" . | nindent 12 }}
           {{- include "currents.emailEnv" . | nindent 12 }}
           {{- include "currents.samlSSOEnv" . | nindent 12 }}
           {{- include "currents.mcpOAuthEnv" . | nindent 12 }}
           {{- include "currents.appContentStorageEnv" . | nindent 12 }}
-          {{- if .Values.currents.betterAuth.secretName }}
             - name: BETTER_AUTH_SECRET
               valueFrom:
                 secretKeyRef:
-                  name: {{ .Values.currents.betterAuth.secretName }}
+                  name: {{ required "currents.betterAuth.secretName is required: the server signs session cookies with it" .Values.currents.betterAuth.secretName }}
                   key: {{ .Values.currents.betterAuth.key }}
-          {{- end }}
-          {{- if .Values.currents.apiInternalToken.secretName }}
             - name: API_SECRET
               valueFrom:
                 secretKeyRef:
-                  name: {{ .Values.currents.apiInternalToken.secretName }}
+                  name: {{ required "currents.apiInternalToken.secretName is required: the director authenticates to the server with this token" .Values.currents.apiInternalToken.secretName }}
                   key: {{ .Values.currents.apiInternalToken.key }}
-          {{- end }}
           {{- with (concat .Values.global.env .Values.server.env) }}
             {{- toYaml . | nindent 12 }}
           {{- end }}
diff --git a/charts/currents/values.yaml b/charts/currents/values.yaml
index 15b23f6..d21d840 100644
--- a/charts/currents/values.yaml
+++ b/charts/currents/values.yaml
@@ -20,7 +20,9 @@ currents:
     # -- The email address of the root user
     email: 'admin@{{ .Values.currents.domains.appHost }}'
     password:
-      # -- The K8s secret containing the root user password. The password is used during initial setup only.
+      # -- The K8s secret containing the root user password, used for the first sign-in
+      # only. Templating fails when it is unset, because the server refuses to start
+      # without `ON_PREM_PASSWORD`. Generate one with `openssl rand -hex 16`.
       # @section -- Required
       secretName: ""
       # -- The K8s secret key for the root user password
@@ -76,7 +78,9 @@ currents:
     # -- Whether to enable the both default ingresses (server, and director)
     enabled: false
   betterAuth:
-    # -- The K8s secret containing the Better Auth secret
+    # -- The K8s secret containing the secret the server signs session cookies with.
+    # Templating fails when it is unset, because the server refuses to start without
+    # `BETTER_AUTH_SECRET`. Generate one with `openssl rand -hex 32`.
     # @section -- Required
     secretName: ""
     # -- The K8s secret key for the Better Auth secret
@@ -140,7 +144,10 @@ currents:
     # @section -- Remote MCP and OAuth
     clientIdMetadataDocuments: true
   apiInternalToken:
-    # -- The K8s secret to use for the internal API token
+    # -- The K8s secret holding the token the director authenticates to the server with;
+    # both deployments read it. Templating fails when it is unset, because an empty
+    # `API_SECRET` leaves the director unable to cancel runs. Generate at least 32 random
+    # characters with `openssl rand -hex 32`.
     # @section -- Required
     secretName: ""
     # -- The K8s secret key to use for the internal API token
diff --git a/docs/configuration.md b/docs/configuration.md
index 6a31f32..abbf5c0 100644
--- a/docs/configuration.md
+++ b/docs/configuration.md
@@ -18,11 +18,11 @@ The following table lists the configurable parameters of the `currents` chart an
 |-----|------|---------|-------------|
 | currents.domains.appHost | string | `"currents-app.localhost"` | The host for the app |
 | currents.domains.recordApiHost | string | `"currents-record.localhost"` | The host for the recording endpoint that the test reporters communicate with |
-| currents.rootUser.password.secretName | string | `""` | The K8s secret containing the root user password. The password is used during initial setup only. |
+| currents.rootUser.password.secretName | string | `""` | The K8s secret containing the root user password, used for the first sign-in only. Templating fails when it is unset, because the server refuses to start without `ON_PREM_PASSWORD`. Generate one with `openssl rand -hex 16`. |
 | currents.email.smtp.host | string | `""` | the SMTP server to use. Required unless `transporter` is `ses`. |
 | currents.email.smtp.secretName | string | `""` | K8s secret to use for the SMTP username/password. Required unless `transporter` is `ses`. |
-| currents.betterAuth.secretName | string | `""` | The K8s secret containing the Better Auth secret |
-| currents.apiInternalToken.secretName | string | `""` | The K8s secret to use for the internal API token |
+| currents.betterAuth.secretName | string | `""` | The K8s secret containing the secret the server signs session cookies with. Templating fails when it is unset, because the server refuses to start without `BETTER_AUTH_SECRET`. Generate one with `openssl rand -hex 32`. |
+| currents.apiInternalToken.secretName | string | `""` | The K8s secret holding the token the director authenticates to the server with; both deployments read it. Templating fails when it is unset, because an empty `API_SECRET` leaves the director unable to cancel runs. Generate at least 32 random characters with `openssl rand -hex 32`. |
 | currents.clickhouse.user.secretName | string | `""` | The k8s secret to use for the ClickHouse password |
 | currents.clickhouse.user.secretPasswordKey | string | `""` | The k8s secret key to use to access the ClickHouse password |
 | currents.clickhouse.user.secretAccessTokenKey | string | `""` | The k8s secret key to use to access the ClickHouse access token |