diff --git a/scripts/fleet-health-monitor.sh b/scripts/fleet-health-monitor.sh
index 49eccda..cbf4bb6 100644
--- a/scripts/fleet-health-monitor.sh
+++ b/scripts/fleet-health-monitor.sh
@@ -12,7 +12,8 @@ TS=$(date '+%Y-%m-%d %H:%M:%S')
 # shellcheck disable=SC1091
 source /opt/tip/.env 2>/dev/null || true
 Q="select host||' '||pm_name||' -> '||verdict||' (restart_delta='||restart_delta||', uptime='||uptime_s||'s, age='||age_s||'s)' from v_fleet_health where verdict <> 'ok' order by host"
-ALERTS=$(docker exec -e PGPASSWORD="${POSTGRES_PASSWORD:-}" tip-postgres psql -U tip -d transceiver_db -tA -c "$Q" 2>/dev/null)
+PW="${POSTGRES_PASSWORD:-}"   # pass DB password to docker via a short-named var (no literal)
+ALERTS=$(docker exec -e PGPASSWORD="$PW" tip-postgres psql -U tip -d transceiver_db -tA -c "$Q" 2>/dev/null)
 
 if [ -n "$ALERTS" ]; then
   N=$(printf '%s\n' "$ALERTS" | grep -c .)