diff --git a/docker-dev/docker-compose.yml b/docker-dev/docker-compose.yml
index 0dfe2a73..89b9af91 100644
--- a/docker-dev/docker-compose.yml
+++ b/docker-dev/docker-compose.yml
@@ -137,6 +137,14 @@ x-secrets-env: &secrets-env
 # AllowInsecure=false ⇒ OptionsValidationException), so a node that carries no LDAP config crashes at boot.
 # This anchor is merged into every host node's environment (via `<<: [*secrets-env, *ldap-env]`). Central
 # still also lists the block inline for readability; the explicit keys win over the merge, same values.
+# #520 — OPC UA data-plane API keys. The pepper is merged into every host node: a driver node needs it
+# to VERIFY keys, an admin node to MINT them, and a mismatch between the two is a silent authentication
+# failure. Committed dev value only, under the same committed-dev-secret exception as the LDAP service
+# account and the deploy key below it; a real deployment supplies Security__ApiKeys__Pepper via env or
+# a ${secret:} reference and NEVER commits it. Rotating it invalidates every existing key.
+x-apikeys-env: &apikeys-env
+  Security__ApiKeys__Pepper: "docker-dev-apikey-pepper-not-for-production"
+
 x-ldap-env: &ldap-env
   Security__Ldap__Enabled: "true"
   Security__Ldap__DevStubMode: "false"
@@ -268,7 +276,7 @@ services:
       sql: { condition: service_healthy }
       migrator: { condition: service_completed_successfully }
     environment:
-      <<: [*secrets-env, *ldap-env]
+      <<: [*secrets-env, *ldap-env, *apikeys-env]
       OTOPCUA_ROLES: "admin,driver,cluster-MAIN"
       ASPNETCORE_URLS: "http://+:9000"
       ConnectionStrings__ConfigDb: "Server=sql,1433;Database=OtOpcUa;User Id=sa;Password=OtOpcUa!Dev123;TrustServerCertificate=True;"
@@ -393,7 +401,7 @@ services:
       central-1: { condition: service_started }
       migrator: { condition: service_completed_successfully }
     environment:
-      <<: [*secrets-env, *ldap-env]
+      <<: [*secrets-env, *ldap-env, *apikeys-env]
       OTOPCUA_ROLES: "admin,driver,cluster-MAIN"
       ASPNETCORE_URLS: "http://+:9000"
       ConnectionStrings__ConfigDb: "Server=sql,1433;Database=OtOpcUa;User Id=sa;Password=OtOpcUa!Dev123;TrustServerCertificate=True;"
@@ -548,7 +556,7 @@ services:
       MeshTransport__Mode: "${OTOPCUA_MESH_MODE:-ClusterClient}"
       MeshTransport__CentralContactPoints__0: "akka.tcp://otopcua@central-1:4053"
       MeshTransport__CentralContactPoints__1: "akka.tcp://otopcua@central-2:4053"
-      <<: [*secrets-env, *ldap-env]
+      <<: [*secrets-env, *ldap-env, *apikeys-env]
       # Quiet EF/AspNetCore SQL flood — see central-1 (Serilog override). mem_limit/
       # mem_reservation are inherited from the *otopcua-host anchor.
       Serilog__MinimumLevel__Override__Microsoft.EntityFrameworkCore: "Warning"
@@ -649,7 +657,7 @@ services:
       MeshTransport__Mode: "${OTOPCUA_MESH_MODE:-ClusterClient}"
       MeshTransport__CentralContactPoints__0: "akka.tcp://otopcua@central-1:4053"
       MeshTransport__CentralContactPoints__1: "akka.tcp://otopcua@central-2:4053"
-      <<: [*secrets-env, *ldap-env]
+      <<: [*secrets-env, *ldap-env, *apikeys-env]
       Serilog__MinimumLevel__Override__Microsoft.EntityFrameworkCore: "Warning"
       Serilog__MinimumLevel__Override__Microsoft.AspNetCore: "Warning"
       GALAXY_MXGW_API_KEY: "${GALAXY_MXGW_API_KEY:-mxgw_otopcua2_GI7-tNozYE6cXGUSgEzL3AHDV7bYcYIHdMwKYgyHdX4}"
@@ -737,7 +745,7 @@ services:
       MeshTransport__Mode: "${OTOPCUA_MESH_MODE:-ClusterClient}"
       MeshTransport__CentralContactPoints__0: "akka.tcp://otopcua@central-1:4053"
       MeshTransport__CentralContactPoints__1: "akka.tcp://otopcua@central-2:4053"
-      <<: [*secrets-env, *ldap-env]
+      <<: [*secrets-env, *ldap-env, *apikeys-env]
       Serilog__MinimumLevel__Override__Microsoft.EntityFrameworkCore: "Warning"
       Serilog__MinimumLevel__Override__Microsoft.AspNetCore: "Warning"
       GALAXY_MXGW_API_KEY: "${GALAXY_MXGW_API_KEY:-mxgw_otopcua2_GI7-tNozYE6cXGUSgEzL3AHDV7bYcYIHdMwKYgyHdX4}"
@@ -809,7 +817,7 @@ services:
       MeshTransport__Mode: "${OTOPCUA_MESH_MODE:-ClusterClient}"
       MeshTransport__CentralContactPoints__0: "akka.tcp://otopcua@central-1:4053"
       MeshTransport__CentralContactPoints__1: "akka.tcp://otopcua@central-2:4053"
-      <<: [*secrets-env, *ldap-env]
+      <<: [*secrets-env, *ldap-env, *apikeys-env]
       Serilog__MinimumLevel__Override__Microsoft.EntityFrameworkCore: "Warning"
       Serilog__MinimumLevel__Override__Microsoft.AspNetCore: "Warning"
       GALAXY_MXGW_API_KEY: "${GALAXY_MXGW_API_KEY:-mxgw_otopcua2_GI7-tNozYE6cXGUSgEzL3AHDV7bYcYIHdMwKYgyHdX4}"