diff --git a/README.md b/README.md
index b9ae77b..50bf172 100644
--- a/README.md
+++ b/README.md
@@ -184,6 +184,7 @@ Rails.application.config.to_prepare do
     #   :database — only WarpEngine::ApplicationToken records with the
     #               "update" scope are accepted; the shared secret stops
     #               working the moment you switch.
+    # Defaults to ENV["UPDATE_SECRET_SOURCE"] (:env when unset).
     # :database mode also requires the owner class every token belongs to:
     # c.update_secret_source = :database
     # c.application_token_owner_class = "AdminUser"
diff --git a/lib/generators/warp_engine/install/templates/initializer.rb b/lib/generators/warp_engine/install/templates/initializer.rb
index ea2cb88..7636abc 100644
--- a/lib/generators/warp_engine/install/templates/initializer.rb
+++ b/lib/generators/warp_engine/install/templates/initializer.rb
@@ -13,6 +13,7 @@ Rails.application.config.to_prepare do
     #   :env      — a fenti shared secret érvényes (default)
     #   :database — csak DB-tárolt WarpEngine::ApplicationToken érvényes
     #               ("update" scope-pal); a shared secret ilyenkor NEM működik.
+    # Default: ENV["UPDATE_SECRET_SOURCE"] (beállítatlanul :env).
     # A :database módhoz kötelező a tokenek tulajdonos-osztálya is:
     # c.update_secret_source = :database
     # c.application_token_owner_class = "AdminUser"
diff --git a/lib/warp_engine/configuration.rb b/lib/warp_engine/configuration.rb
index e629785..a32c003 100644
--- a/lib/warp_engine/configuration.rb
+++ b/lib/warp_engine/configuration.rb
@@ -20,7 +20,7 @@ module WarpEngine
       @file_container_path           = ENV.fetch("FILE_CONTAINER_PATH", "/softwares")
       @image_container_path          = ENV.fetch("IMAGE_CONTAINER_PATH", "/images")
       @update_secret                 = ENV["UPDATE_SECRET"]
-      @update_secret_source          = :env
+      @update_secret_source          = ENV.fetch("UPDATE_SECRET_SOURCE", "env").to_sym
       @application_token_owner_class = nil
       @image_owners                  = []
     end