diff --git a/.dockerignore b/.dockerignore
new file mode 100644
index 0000000..d3a7403
--- /dev/null
+++ b/.dockerignore
@@ -0,0 +1,11 @@
+*.py[co]
+db.sqlite3
+*.swp
+spejstore.env
+env/
+backups
+media/
+django-tree/
+postgres-hstore/
+.ropeproject/
+docker-compose.yml
diff --git a/.gitignore b/.gitignore
index 9ada545..88f868a 100644
--- a/.gitignore
+++ b/.gitignore
@@ -8,3 +8,4 @@ media/
 django-tree/
 postgres-hstore/
 .ropeproject/
+docker-compose.override.yml
diff --git a/Dockerfile b/Dockerfile
index 190c716..7bc1528 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,4 +1,4 @@
-FROM python:3.5
+FROM python:3.5.9@sha256:3a71fd2dac2343263993f4ab898c9398dfbfd0235dafe41e784876b69bdfa899
 ENV PYTHONUNBUFFERED 1
 RUN mkdir /code
 WORKDIR /code
diff --git a/README.md b/README.md
index 5f73f23..a098ef5 100644
--- a/README.md
+++ b/README.md
@@ -7,13 +7,12 @@ Please use Python3, for the love of `$deity`...
 
 ### Quick start
 
-1. Open `docker-compose.yml` and make changes as comments indicate (TODO: Please someone make this not awful)
-2. Run:
+1. Run:
     ```sh
+    ln -s docker-compose.dev-override.yml docker-compose.override.yml
     docker-compose up --build
     ```
-3. Open `spejstore/urls.py` and comment out `url(r'^admin/login/.*', auth_redirect),`
-4. Run `docker-compose run --rm web python manage.py createsuperuser` -- now you can dev authenticate w/o SSO
+2. Run `docker-compose run --rm web python manage.py createsuperuser` -- now you can dev authenticate w/o SSO
 
 ### Build & run
 
diff --git a/docker-compose.dev-override.yml b/docker-compose.dev-override.yml
new file mode 100644
index 0000000..61d7fd5
--- /dev/null
+++ b/docker-compose.dev-override.yml
@@ -0,0 +1,6 @@
+version: "3"
+services:
+  web:
+    environment:
+      - SPEJSTORE_ENV=dev
+      - SPEJSTORE_ALLOWED_HOSTS=localhost,127.0.0.1
diff --git a/docker-compose.prod-override.yml b/docker-compose.prod-override.yml
new file mode 100644
index 0000000..1855612
--- /dev/null
+++ b/docker-compose.prod-override.yml
@@ -0,0 +1,6 @@
+version: "3"
+
+services:
+  db:
+    volumes:
+      - /var/spejstore-data:/var/lib/postgresql/data
diff --git a/docker-compose.yml b/docker-compose.yml
index 7dfc852..6adb841 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -1,14 +1,10 @@
-version: "2.3"
+version: "3"
 services:
   db:
     build: postgres-hstore
     restart: always
-    # NOTE: Comment out `volumes` for development
-    volumes:
-      - /var/spejstore-data:/var/lib/postgresql/data
-    # NOTE: Uncomment this awful thing for development
-    # environment:
-      # - POSTGRES_HOST_AUTH_METHOD=trust
+    environment:
+     - POSTGRES_HOST_AUTH_METHOD=trust
 
   web:
     build: .
@@ -20,8 +16,7 @@ services:
       - "8000:8000"
     depends_on:
       - db
-
-    env_file:
-      - spejstore-dev.env
-      # NOTE: Comment out this for development
-      - spejstore.env
+    environment:
+      - SPEJSTORE_CLIENT_ID
+      - SPEJSTORE_SECRET
+      - SPEJSTORE_ENV
diff --git a/postgres-hstore/Dockerfile b/postgres-hstore/Dockerfile
index cb97d3d..7b59873 100644
--- a/postgres-hstore/Dockerfile
+++ b/postgres-hstore/Dockerfile
@@ -1,3 +1,3 @@
-FROM postgres:latest
+FROM postgres:9.6.17@sha256:5b39dd4a26a02fee26902c84d8bafb2eb0ab9a2874fb0be22056107aa6508899
 MAINTAINER Piotr Dobrowolski
 ADD create_extension.sh /docker-entrypoint-initdb.d/create_extension.sh
diff --git a/spejstore/urls.py b/spejstore/urls.py
index 9cb95f3..ccf0b8d 100644
--- a/spejstore/urls.py
+++ b/spejstore/urls.py
@@ -21,8 +21,9 @@ router.register(r'labels', apiviews.LabelViewSet)
 
 # Wire up our API using automatic URL routing.
 # Additionally, we include login URLs for the browsable API.
-urlpatterns = [
+urlpatterns = ([
     url(r'^admin/login/.*', auth_redirect),
+] if settings.PROD else []) + [
     url(r'^admin/', admin.site.urls),
     url(r'^select2/', include('django_select2.urls')),