diff --git a/README.md b/README.md
index 5cce0fb..bf3b387 100644
--- a/README.md
+++ b/README.md
@@ -41,13 +41,14 @@ view that tracks which rules are actually earning their keep versus generating n
 is based on evidence, not guesswork.
 
 ### 🧠 ANIS Threat Intelligence
-ARGUS ships connected by default to **ANIS (Argus Network Intelligence Server)**, a
+ARGUS ships connected by default to **ANIS (Argus Network Intelligence Server)**, Weboria's
 community-powered reputation network: every ARGUS deployment that opts in contributes
 confirmed-attacker IPs and receives the aggregated blocklist back in return, so your appliance
 gets smarter from day one using signal from every other protected site — no license key
 required for the free Community tier. Every dashboard, investigation view, and auto-ban
-decision is enriched with live ANIS reputation scoring. Prefer to keep intelligence in-house?
-Point ARGUS at your own self-hosted ANIS instance instead, or turn the integration off entirely.
+decision is enriched with live ANIS reputation scoring. A license key upgrades the tier —
+manage it entirely from Threat Intel → ANIS Connection in the dashboard, or turn the
+integration off entirely from the same page.
 
 ### 🌐 Attack Origin Visualization
 A live global map of inbound attacks — real-time arcs from source to your infrastructure,
@@ -228,9 +229,9 @@ for the rest of the options (clearing 2FA, etc.).
 
 ARGUS connects to **ANIS**, Weboria's threat-intelligence hub, to share confirmed attacker IPs
 and receive a community blocklist in return. Enabled by default against the public Community
-Edition hub — no license key required. Point `ANIS_URL` at your own self-hosted ANIS instead if
-you run one, or set `ANIS_ENABLED=false` to turn this off entirely. See the comments in
-`env.example` for the full set of options.
+Edition hub — no license key required. Set `ANIS_ENABLED=false` in `.env` to turn this off
+entirely. A license key upgrades the tier — set it from Threat Intel → ANIS Connection in the
+dashboard, not from `.env`.
 
 ---
 
@@ -253,9 +254,10 @@ served at `https://<your-server-address>:81/api/docs` once ARGUS is running.
 | `NGINX_HTTP_PORT` / `NGINX_HTTPS_PORT` | Reverse-proxy listen ports | `80` / `443` |
 | `API_HOST_PORT` | Internal API port exposed to the host | `9080` |
 | `DNS_LISTEN_HOST` | DNS Security Engine bind address | `127.0.0.1` |
-| `ANIS_ENABLED` / `ANIS_URL` | Threat-intel hub integration | `true` / `https://anis.weboria.eu` |
+| `ANIS_ENABLED` | Threat-intel hub integration | `true` |
 
-Full list with descriptions in `env.example`.
+Full list with descriptions in `env.example`. ANIS's URL is fixed (`https://anis.weboria.eu`,
+not configurable) and its license key is dashboard-only — neither is an env var.
 
 ---
 
diff --git a/docker-compose.yml b/docker-compose.yml
index e15418a..8376c5d 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -123,16 +123,19 @@ services:
       API_HOST_PORT: ${API_HOST_PORT:-9080}
       API_HOST: ${API_HOST:-}
       # ANIS community intelligence — on by default against the public
-      # Community Edition hub (empty license key = community tier, no signup
-      # required). These three only matter on first boot; manage the
-      # connection afterward from Threat Intel -> ANIS Connection in the
-      # dashboard. (No ANIS_ADMIN_KEY here: it's ANIS's own admin-dashboard
-      # credential, unrelated to the ARGUS<->ANIS protocol, which ARGUS never
-      # sends — a prior version of this file carried it by mistake.)
-      ANIS_ENABLED:          ${ANIS_ENABLED:-true}
-      ANIS_URL:              ${ANIS_URL:-https://anis.weboria.eu}
-      ANIS_LICENSE_KEY:      ${ANIS_LICENSE_KEY:-}
-      ANIS_SHARE_ATTACKERS:  ${ANIS_SHARE_ATTACKERS:-false}
+      # Community Edition hub (community tier, no signup required). There is
+      # no self-hosted-ANIS deployment model: the URL is fixed, not
+      # customer-configurable. A license key upgrades the tier, but is only
+      # ever set from Threat Intel -> ANIS Connection in the dashboard
+      # (write-only there — never round-trips back to the client), not from
+      # this file, so it's seeded empty (community tier) here.
+      # (No ANIS_ADMIN_KEY or ANIS_SHARE_ATTACKERS here: both confirmed dead
+      # via grep, zero references anywhere in internal/config.go or the ANIS
+      # client. A prior version of this file carried ANIS_ADMIN_KEY and
+      # falsely claimed ARGUS "fails closed at startup" without it.)
+      ANIS_ENABLED: ${ANIS_ENABLED:-true}
+      ANIS_URL: https://anis.weboria.eu
+      ANIS_LICENSE_KEY: ""
       DNS_SECURITY_LISTEN_ADDR: ":53"
     ports:
       - "127.0.0.1:${API_HOST_PORT:-9080}:8080"
diff --git a/env.example b/env.example
index 82e2c9a..da2514a 100644
--- a/env.example
+++ b/env.example
@@ -26,15 +26,11 @@ TZ=UTC
 # Threat Intelligence (ANIS)
 # ===========================================
 # ARGUS connects to ANIS, Weboria's threat-intelligence network, by default
-# — no license key needed for the free Community tier. These three values
-# only matter on first boot; manage the connection afterward from
-# Threat Intel -> ANIS Connection in the dashboard.
+# — no license key needed for the free Community tier. There is no
+# self-hosted-ANIS deployment model, so there's no URL to configure here.
+# A license key upgrades the tier, but is only ever set from
+# Threat Intel -> ANIS Connection in the dashboard — never from this file.
 ANIS_ENABLED=true
-ANIS_URL=https://anis.weboria.eu
-ANIS_LICENSE_KEY=
-
-# Share this instance's confirmed attacker IPs back to the community feed?
-ANIS_SHARE_ATTACKERS=false
 
 # ===========================================
 # Network Ports