diff --git a/frontend/src/content/en/application/configuration.mdx b/frontend/src/content/en/application/configuration.mdx
index c33a178a9..5140f38da 100644
--- a/frontend/src/content/en/application/configuration.mdx
+++ b/frontend/src/content/en/application/configuration.mdx
@@ -319,6 +319,37 @@ When the config schema changes, `config_version` is bumped. To merge new fields
 make config-upgrade
 ```
 
+## Runtime environment variables
+
+DeerFlow reads these from its own process environment — via a `.env` file, the
+Docker environment, or the shell.
+
+Only `DEER_FLOW_SKILLS_PATH` resolves a relative value against
+`DEER_FLOW_PROJECT_ROOT`. `DEER_FLOW_HOME` and `DEER_FLOW_CONFIG_PATH` are used
+as given, so a relative value resolves against the process working directory —
+set both to absolute paths so writable state and the loaded config file land
+where you expect them.
+
+| Variable                 | Default                            | Description                                                                                 |
+| ------------------------ | ---------------------------------- | ------------------------------------------------------------------------------------------- |
+| `DEER_FLOW_PROJECT_ROOT` | current working directory          | Root for project-relative defaults, including the `skills` lookup                           |
+| `DEER_FLOW_HOME`         | `<project root>/.deer-flow`        | Writable directory for runtime state (threads, uploads); use an absolute path               |
+| `DEER_FLOW_CONFIG_PATH`  | auto-discovered under project root | Absolute path to `config.yaml`                                                              |
+| `DEER_FLOW_SKILLS_PATH`  | `<project root>/skills`            | Directory containing skill definitions (a relative value resolves against the project root) |
+| `AUTH_JWT_SECRET`        | auto-generated                     | JWT signing secret for the Gateway                                                          |
+
+Log verbosity is not an environment variable — set `log_level` in `config.yaml`
+instead (`debug`, `info`, `warning`, or `error`; default `info`). See
+[Harness Configuration](/docs/harness/configuration) for the module reference.
+
+`DEER_FLOW_ROOT` is a host-side variable for the Docker Compose dev stack only;
+the DeerFlow process does not read it. See the
+[Deployment Guide](/docs/application/deployment-guide).
+
+When `AUTH_JWT_SECRET` is unset, DeerFlow generates a secret on first start and
+persists it to `.jwt_secret`, so sessions survive restarts. Set it explicitly in
+production to keep a stable, secret value.
+
 <Cards num={2}>
   <Cards.Card
     title="Deployment Guide"
diff --git a/frontend/src/content/zh/application/configuration.mdx b/frontend/src/content/zh/application/configuration.mdx
index 8ea3dbbdd..e8df2f743 100644
--- a/frontend/src/content/zh/application/configuration.mdx
+++ b/frontend/src/content/zh/application/configuration.mdx
@@ -264,13 +264,25 @@ BETTER_AUTH_SECRET=local-dev-secret-at-least-32-chars
 
 ## 运行时环境变量
 
-这些变量在 DeerFlow 进程中设置（通过 `.env`、Docker 环境或 shell）：
+这些变量由 DeerFlow 进程自身读取（通过 `.env`、Docker 环境或 shell）。
 
-| 变量                    | 默认值           | 描述                                             |
-| ----------------------- | ---------------- | ------------------------------------------------ |
-| `DEER_FLOW_CONFIG_PATH` | 自动发现         | `config.yaml` 的绝对路径                         |
-| `LOG_LEVEL`             | `info`           | 日志详细程度（`debug`/`info`/`warning`/`error`） |
-| `DEER_FLOW_ROOT`        | 仓库根目录       | 用于 Docker 中的技能和线程挂载                   |
+这些路径变量中，只有 `DEER_FLOW_SKILLS_PATH` 会把相对值基于 `DEER_FLOW_PROJECT_ROOT` 解析；
+`DEER_FLOW_HOME` 和 `DEER_FLOW_CONFIG_PATH` 都按原值直接使用，相对值会基于进程工作目录解析。
+请为这两个变量设置绝对路径，确保可写状态与加载的配置文件落在预期的位置。
+
+| 变量                     | 默认值                 | 描述                                                   |
+| ------------------------ | ---------------------- | ------------------------------------------------------ |
+| `DEER_FLOW_PROJECT_ROOT` | 当前工作目录           | 解析项目相对默认值（含 `skills` 查找）的根目录         |
+| `DEER_FLOW_HOME`         | `<项目根>/.deer-flow`  | 运行状态的可写目录（线程、上传文件）；建议使用绝对路径 |
+| `DEER_FLOW_CONFIG_PATH`  | 在项目根目录下自动发现 | `config.yaml` 的绝对路径                               |
+| `DEER_FLOW_SKILLS_PATH`  | `<项目根>/skills`      | 技能定义所在目录（相对值基于项目根解析）               |
+| `AUTH_JWT_SECRET`        | 自动生成               | Gateway 的 JWT 签名密钥                                |
+
+日志级别不是环境变量——请在 `config.yaml` 中设置 `log_level`（`debug`、`info`、`warning` 或 `error`，默认 `info`）。模块参考见 [Harness 配置](/docs/harness/configuration)。
+
+`DEER_FLOW_ROOT` 仅是 Docker Compose 开发栈使用的主机侧变量，DeerFlow 进程不会读取它，详见[部署指南](/docs/application/deployment-guide)。
+
+当 `AUTH_JWT_SECRET` 未设置时，DeerFlow 会在首次启动时生成一个密钥并持久化到 `.jwt_secret`，重启后会话仍然有效；生产环境请显式设置一个稳定的随机值。
 
 <Cards num={2}>
   <Cards.Card title="Harness 配置" href="/docs/harness/configuration" />