diff --git a/Dockerfile b/Dockerfile
index c17e27a..cc92d82 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -12,8 +12,7 @@ RUN npm run build
 # Serve the static files using a lightweight web server
 FROM nginx:alpine
 COPY --from=builder /app/dist /usr/share/nginx/html
-# nginx.conf is a template. An env var that is not set stays in it as ${...}, and nginx then fails to start.
-ENV AUTH_HOST="" API_HOST=""
+COPY --chmod=0755 docker-entrypoint.d/10-require-hosts.sh /docker-entrypoint.d/
 COPY nginx.conf /etc/nginx/templates/default.conf.template
 EXPOSE 80
 CMD ["nginx", "-g", "daemon off;"]
\ No newline at end of file
diff --git a/README.md b/README.md
index 59528e4..c524d14 100644
--- a/README.md
+++ b/README.md
@@ -405,7 +405,8 @@ Production image (container env, read by nginx at start):
 | `AUTH_HOST` | Auth host name for the CSP `connect-src` |
 | `API_HOST` | Core host name, same |
 
-Both default to empty in the image; `docker-compose.yml` of the Deployment repo passes them. `FRONTEND_HOST` is not
+The image refuses to start when either is unset or empty (`docker-entrypoint.d/10-require-hosts.sh`);
+`docker-compose.yml` of the Deployment repo passes both. `FRONTEND_HOST` is not
 passed to the frontend image; compose uses it for the Traefik rule and as `APP_FRONTEND_URL` of Auth and Core (Deployment `docker-compose.yml`:68,152).
 
 ## Tests and build
diff --git a/docker-entrypoint.d/10-require-hosts.sh b/docker-entrypoint.d/10-require-hosts.sh
new file mode 100755
index 0000000..61564bc
--- /dev/null
+++ b/docker-entrypoint.d/10-require-hosts.sh
@@ -0,0 +1,4 @@
+#!/bin/sh
+# Empty hosts would give a CSP connect-src that blocks every API call. Runs before 20-envsubst-on-templates.sh.
+: "${AUTH_HOST:?set AUTH_HOST (public host name of Auth) in the container env}"
+: "${API_HOST:?set API_HOST (public host name of Core) in the container env}"