diff --git a/src/pages/selfhosted/scaling-your-self-hosted-deployment.mdx b/src/pages/selfhosted/scaling-your-self-hosted-deployment.mdx
index e4ea3229..1f7d3c45 100644
--- a/src/pages/selfhosted/scaling-your-self-hosted-deployment.mdx
+++ b/src/pages/selfhosted/scaling-your-self-hosted-deployment.mdx
@@ -450,12 +450,22 @@ mkdir -p ~/netbird-signal
 cd ~/netbird-signal
 ```
 
-Like the relay, the signal server can automatically obtain TLS certificates via Let's Encrypt. Unlike the relay, the signal server requires CLI flags for configuration.
+Like the relay, the signal server can automatically obtain TLS certificates via Let's Encrypt.
 
 <Note>
 Replace `signal.example.com` with your signal server's domain.
 </Note>
 
+Create `signal.env` with your signal settings:
+
+```bash
+NB_PORT=443
+NB_LOG_LEVEL=info
+
+# TLS via Let's Encrypt (automatic certificate provisioning)
+NB_LETSENCRYPT_DOMAIN=signal.example.com
+```
+
 Create `docker-compose.yml`:
 
 ```yaml
@@ -467,7 +477,8 @@ services:
     ports:
       - '443:443'
       - '80:80'
-    command: ["--port", "443", "--letsencrypt-domain", "signal.example.com"]
+    env_file:
+      - signal.env
     volumes:
       - signal_data:/var/lib/netbird
     logging:
@@ -482,10 +493,17 @@ volumes:
 
 ### 5.3 Alternative: TLS with Existing Certificates
 
-If you have existing TLS certificates, replace the `--letsencrypt-domain` flag with certificate paths:
+If you have existing TLS certificates, replace the Let's Encrypt variable in `signal.env` with:
+
+```bash
+# Replace the NB_LETSENCRYPT_DOMAIN line with:
+NB_CERT_FILE=/certs/fullchain.pem
+NB_CERT_KEY=/certs/privkey.pem
+```
+
+And add a certificate volume to `docker-compose.yml`:
 
 ```yaml
-    command: ["--port", "443", "--cert-file", "/certs/fullchain.pem", "--cert-key", "/certs/privkey.pem"]
     volumes:
       - /path/to/certs:/certs:ro
       - signal_data:/var/lib/netbird