diff --git a/Dockerfile b/Dockerfile
index 88a3922..18b8898 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -2,9 +2,9 @@
 FROM node:24-slim AS build
 WORKDIR /app
 
-# Placeholder values ONLY so `vite build` doesn't crash on $env/static/*
-# imports during the build step. These are NOT the real runtime values —
-# App Platform injects the real ones as env vars when the container runs.
+# Placeholder values for build-time $env/static/* and better-auth's module-scope
+# secret validation. These are NOT the real runtime values — App Platform
+# injects the real ones as env vars when the container runs.
 ARG DATABASE_URL=postgres://placeholder:placeholder@localhost:5432/placeholder
 ARG ORIGIN=http://localhost:3000
 ARG BETTER_AUTH_URL=http://localhost:3000
diff --git a/src/lib/server/email-verification.ts b/src/lib/server/email-verification.ts
index d0122a1..b5dfdb9 100644
--- a/src/lib/server/email-verification.ts
+++ b/src/lib/server/email-verification.ts
@@ -1,8 +1,8 @@
-import { BETTER_AUTH_URL } from '$env/static/private';
+import { env } from '$env/dynamic/private';
 import { sendMail } from './resend';
 
 export async function sendVerificationEmail(options: { email: string; token: string }) {
-	const verificationUrl = `${BETTER_AUTH_URL}/api/auth/verify-email?token=${options.token}&callbackURL=/login?verified=true`;
+	const verificationUrl = `${env.BETTER_AUTH_URL}/api/auth/verify-email?token=${options.token}&callbackURL=/login?verified=true`;
 
 	await sendMail({
 		to: options.email,
diff --git a/src/lib/server/resend.ts b/src/lib/server/resend.ts
index dc8d7f4..3af07b7 100644
--- a/src/lib/server/resend.ts
+++ b/src/lib/server/resend.ts
@@ -9,9 +9,9 @@
  *
  */
 import { Resend } from 'resend';
-import { RESEND_API_KEY, EMAIL_FROM, RESEND_TEMPLATE_ID } from '$env/static/private';
+import { env } from '$env/dynamic/private';
 
-export const resend = new Resend(RESEND_API_KEY);
+export const resend = new Resend(env.RESEND_API_KEY);
 
 /**
  * Send a transactional email using a Resend-hosted template.
@@ -39,11 +39,11 @@ export async function sendMail(options: {
 	const { to, subject, templateId, data } = options;
 
 	const result = await resend.emails.send({
-		from: EMAIL_FROM,
+		from: env.EMAIL_FROM,
 		to: [to],
 		subject: subject ?? 'Template Email',
 		template: {
-			id: templateId ?? RESEND_TEMPLATE_ID,
+			id: templateId ?? env.RESEND_TEMPLATE_ID,
 			variables: data ?? {}
 		}
 	});
diff --git a/src/routes/api/v1/automations/create/account/+server.ts b/src/routes/api/v1/automations/create/account/+server.ts
index f62e994..dc11696 100644
--- a/src/routes/api/v1/automations/create/account/+server.ts
+++ b/src/routes/api/v1/automations/create/account/+server.ts
@@ -3,7 +3,7 @@ import { json, error } from '@sveltejs/kit';
 import { auth } from '$lib/auth';
 import { prisma } from '$lib/db';
 import { sendMail } from '$lib/server/resend';
-import { BETTER_AUTH_URL } from '$env/static/private';
+import { env } from '$env/dynamic/private';
 
 function generateLicenseKey(): string {
 	const hex = crypto.randomUUID().replace(/-/g, '').slice(0, 16).toUpperCase();
@@ -53,8 +53,8 @@ export const POST: RequestHandler = async ({ request }) => {
 			});
 
 			const verifyUrl = verification
-				? `${BETTER_AUTH_URL}/api/auth/verify-email?token=${verification.value}&callbackURL=/login?verified=true`
-				: `${BETTER_AUTH_URL}/login`;
+				? `${env.BETTER_AUTH_URL}/api/auth/verify-email?token=${verification.value}&callbackURL=/login?verified=true`
+				: `${env.BETTER_AUTH_URL}/login`;
 
 			await sendMail({
 				to: email,
@@ -64,7 +64,7 @@ export const POST: RequestHandler = async ({ request }) => {
 					firstName: name ?? email.split('@')[0],
 					tempPassword,
 					verifyUrl,
-					loginUrl: `${BETTER_AUTH_URL}/login`
+					loginUrl: `${env.BETTER_AUTH_URL}/login`
 				}
 			});
 		} catch (err) {