diff --git a/internal/api/router.go b/internal/api/router.go
index 18b299031..fae383aa1 100644
--- a/internal/api/router.go
+++ b/internal/api/router.go
@@ -351,13 +351,34 @@ echo "You will need to log in with your saved credentials."
 				json.NewEncoder(w).Encode(response)
 				
 			} else if isDocker {
-				// For Docker, we can't modify the running container
-				// But we can save settings and provide docker run command
+				// For Docker, save credentials to persistent storage
+				// Docker containers need to persist auth config to /etc/pulse
+				envPath := filepath.Join(r.config.ConfigPath, ".env")
+				envContent := fmt.Sprintf(`# Auto-generated by Pulse Quick Security Setup
+# Generated on %s
+PULSE_AUTH_USER=%s
+PULSE_AUTH_PASS=%s
+API_TOKEN=%s
+ENABLE_AUDIT_LOG=true
+`, time.Now().Format(time.RFC3339), setupRequest.Username, hashedPassword, hashedToken)
+				
+				// Ensure directory exists
+				os.MkdirAll(r.config.ConfigPath, 0755)
+				
+				if err := os.WriteFile(envPath, []byte(envContent), 0600); err != nil {
+					log.Error().Err(err).Str("path", envPath).Msg("Failed to write .env file in Docker")
+					http.Error(w, "Failed to save security configuration", http.StatusInternalServerError)
+					return
+				}
+				
+				log.Info().Str("path", envPath).Msg("Docker security configuration saved")
+				
 				response := map[string]interface{}{
 					"success": true,
 					"method": "docker",
 					"requiresManualRestart": true,
-					"message": "Security configuration generated. Restart your Docker container with the environment variables shown.",
+					"message": "Security configuration saved. Restart your Docker container to apply settings.",
+					"note": "Your credentials have been saved and will persist after restart.",
 				}
 				
 				w.Header().Set("Content-Type", "application/json")
@@ -368,11 +389,12 @@ echo "You will need to log in with your saved credentials."
 				// Save to .env file for next restart
 				envPath := filepath.Join(r.config.ConfigPath, ".env")
 				envContent := fmt.Sprintf(`# Auto-generated by Pulse Quick Security Setup
+# Generated on %s
 PULSE_AUTH_USER=%s
 PULSE_AUTH_PASS=%s
 API_TOKEN=%s
 ENABLE_AUDIT_LOG=true
-`, setupRequest.Username, setupRequest.Password, setupRequest.APIToken)
+`, time.Now().Format(time.RFC3339), setupRequest.Username, hashedPassword, hashedToken)
 				
 				if err := os.WriteFile(envPath, []byte(envContent), 0600); err != nil {
 					log.Error().Err(err).Msg("Failed to write .env file")