diff --git a/docker-dev/docker-compose.yml b/docker-dev/docker-compose.yml
index b2b6914d..b637f413 100644
--- a/docker-dev/docker-compose.yml
+++ b/docker-dev/docker-compose.yml
@@ -168,12 +168,18 @@ services:
       Security__Ldap__GroupToRole__WriteTune: "WriteTune"
       Security__Ldap__GroupToRole__WriteConfigure: "WriteConfigure"
       Security__Ldap__GroupToRole__AlarmAck: "AlarmAck"
-      # A2 live-verify: server-side HistoryRead against the Wonderware sidecar on the WW Historian VM.
-      # SharedSecret injected via env at `docker compose up` (never committed). Port = the sidecar's TCP listen port.
-      ServerHistorian__Enabled: "true"
-      ServerHistorian__Host: "10.100.0.48"
-      ServerHistorian__Port: "32569"
-      ServerHistorian__SharedSecret: "${OTOPCUA_HISTORIAN_SECRET:-}"
+      # Server-side HistoryRead via the ZB.MOM.WW.HistorianGateway sidecar. DISABLED by default: the
+      # docker-dev rig has no historian gateway to point at, and the historian-gateway cutover retired the
+      # old Wonderware Host/Port/SharedSecret keys — the code now reads ServerHistorian__Endpoint and builds
+      # a Uri from it, so Enabled=true with an empty Endpoint crashes the Host at startup
+      # (HistorianGatewayClientAdapter.Create -> UriFormatException "The URI is empty").
+      # To enable: OTOPCUA_HISTORIAN_ENABLED=true + OTOPCUA_HISTORIAN_ENDPOINT=https://<host>:5222, and
+      # export ServerHistorian__ApiKey=histgw_<id>_<secret> at `docker compose up` (never commit the key).
+      ServerHistorian__Enabled: "${OTOPCUA_HISTORIAN_ENABLED:-false}"
+      ServerHistorian__Endpoint: "${OTOPCUA_HISTORIAN_ENDPOINT:-}"
+      ServerHistorian__ApiKey: "${ServerHistorian__ApiKey:-}"
+      ServerHistorian__UseTls: "true"
+      ServerHistorian__AllowUntrustedServerCertificate: "true"
       # Pin EF Core + ASP.NET Core to Warning so the per-poll Deployment SELECT /
       # "Executed DbCommand" Information|Debug lines stop flooding the Serilog
       # pipeline and starving the Akka cluster heartbeat thread. The host logs via
@@ -221,12 +227,18 @@ services:
       Security__Ldap__GroupToRole__WriteTune: "WriteTune"
       Security__Ldap__GroupToRole__WriteConfigure: "WriteConfigure"
       Security__Ldap__GroupToRole__AlarmAck: "AlarmAck"
-      # A2 live-verify: server-side HistoryRead against the Wonderware sidecar on the WW Historian VM.
-      # SharedSecret injected via env at `docker compose up` (never committed). Port = the sidecar's TCP listen port.
-      ServerHistorian__Enabled: "true"
-      ServerHistorian__Host: "10.100.0.48"
-      ServerHistorian__Port: "32569"
-      ServerHistorian__SharedSecret: "${OTOPCUA_HISTORIAN_SECRET:-}"
+      # Server-side HistoryRead via the ZB.MOM.WW.HistorianGateway sidecar. DISABLED by default: the
+      # docker-dev rig has no historian gateway to point at, and the historian-gateway cutover retired the
+      # old Wonderware Host/Port/SharedSecret keys — the code now reads ServerHistorian__Endpoint and builds
+      # a Uri from it, so Enabled=true with an empty Endpoint crashes the Host at startup
+      # (HistorianGatewayClientAdapter.Create -> UriFormatException "The URI is empty").
+      # To enable: OTOPCUA_HISTORIAN_ENABLED=true + OTOPCUA_HISTORIAN_ENDPOINT=https://<host>:5222, and
+      # export ServerHistorian__ApiKey=histgw_<id>_<secret> at `docker compose up` (never commit the key).
+      ServerHistorian__Enabled: "${OTOPCUA_HISTORIAN_ENABLED:-false}"
+      ServerHistorian__Endpoint: "${OTOPCUA_HISTORIAN_ENDPOINT:-}"
+      ServerHistorian__ApiKey: "${ServerHistorian__ApiKey:-}"
+      ServerHistorian__UseTls: "true"
+      ServerHistorian__AllowUntrustedServerCertificate: "true"
       # Quiet EF/AspNetCore SQL flood — see central-1 (Serilog override). mem_limit/
       # mem_reservation are inherited from the *otopcua-host anchor.
       Serilog__MinimumLevel__Override__Microsoft.EntityFrameworkCore: "Warning"