diff --git a/.env.example b/.env.example
index d62acca..b259c64 100644
--- a/.env.example
+++ b/.env.example
@@ -41,8 +41,9 @@ FRONTEND_PORT=80
 
 # ── Emails ────────────────────────────────────────────────────────────────────
 # Base URL used to build links in outbound emails (set-password, etc).
-# Must match your real public frontend URL — the app falls back to
-# http://localhost:5173 (dev default) if this is not set.
+# REQUIRED in production — must be THIS deployment's real public frontend
+# URL. There is no safe default (it's unique per deployment); the backend
+# refuses to start without it when AEGIS_ENV=production.
 PLATFORM_URL=https://your-domain.com
 
 # ── Environment flag ─────────────────────────────────────────────────────────
diff --git a/backend/app/config.py b/backend/app/config.py
index 500410b..4561504 100644
--- a/backend/app/config.py
+++ b/backend/app/config.py
@@ -211,3 +211,14 @@ if _is_production:
                 f"Set a strong value via the {name} environment variable "
                 f"before running in production."
             )
+
+    # PLATFORM_URL has no safe production default — it's baked into every
+    # emailed link (set-password, notifications). Falling back silently to
+    # the dev value (or to some other deployment's hardcoded domain) would
+    # ship broken/wrong links without anyone noticing.
+    if settings.PLATFORM_URL == "http://localhost:5173":
+        raise RuntimeError(
+            "CRITICAL: PLATFORM_URL is not configured. Set it to this "
+            "deployment's real public frontend URL via the PLATFORM_URL "
+            "environment variable before running in production."
+        )
diff --git a/docker-compose.prod.yml b/docker-compose.prod.yml
index e90e0c0..24dc8db 100644
--- a/docker-compose.prod.yml
+++ b/docker-compose.prod.yml
@@ -91,8 +91,9 @@ services:
       REDIS_CACHE_DB: ${REDIS_CACHE_DB:-2}
       CORS_ORIGINS: ${CORS_ORIGINS:-}
       # Base URL used to build links in outbound emails (set-password, etc).
-      # Must be the real public frontend URL, not the dev default.
-      PLATFORM_URL: ${PLATFORM_URL:-http://aegis.undiamagico.es}
+      # No default on purpose — every deployment has a different domain;
+      # the backend refuses to start in production without this set.
+      PLATFORM_URL: ${PLATFORM_URL:?Set PLATFORM_URL in your .env file to this deployment's real public frontend URL}
       AEGIS_ENV: ${AEGIS_ENV:-production}
       SECURE_COOKIES: ${SECURE_COOKIES:-false}
       ADMIN_USERNAME: ${ADMIN_USERNAME:-admin}