diff --git a/docker-compose.yml b/docker-compose.yml
index 2a447ad..486619d 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -34,8 +34,14 @@ services:
       - AUTHELIA_SESSION_SECRET_FILE=/secrets/SESSION_SECRET
       - AUTHELIA_STORAGE_ENCRYPTION_KEY_FILE=/secrets/STORAGE_ENCRYPTION_KEY
       - TZ=${TZ:-UTC}
-      # Passed through so authelia/configuration.yml can use {{ env "DOMAIN" }}
-      # instead of hardcoding your domain in the config file.
+      # Enables Go-template substitution in configuration.yml so
+      # `{{ env "DOMAIN" }}` actually expands instead of being read as a
+      # literal string. Without this, Authelia parses the braces as part
+      # of the hostname and validate-config fails with `invalid character
+      # "{" in host name`. Inherited by `docker compose run --rm authelia`,
+      # so validate-config picks it up too.
+      - X_AUTHELIA_CONFIG_FILTERS=template
+      # Passed through so authelia/configuration.yml can use {{ env "DOMAIN" }}.
       - DOMAIN=${DOMAIN}
     volumes:
       - ./authelia:/config