diff --git a/infra/occupymedia/docker-compose.app.yml b/infra/occupymedia/docker-compose.app.yml
index 9113fc4..34a5117 100644
--- a/infra/occupymedia/docker-compose.app.yml
+++ b/infra/occupymedia/docker-compose.app.yml
@@ -98,6 +98,10 @@ services:
       # Publishing workflows and the scheduler worker MUST share one queue,
       # else approved publishes sit unconsumed.
       TEMPORAL_TASK_QUEUE: ${TEMPORAL_TASK_QUEUE:-tmbh-publishing}
+      # Deployment-verified Mastodon Idempotency-Key origins (policy.ts). Media
+      # posts are two mutations (media upload + status create); the dispatch
+      # gate allows the second only for origins listed here.
+      MASTODON_PUBLISH_DEDUPE_ORIGINS: ${MASTODON_PUBLISH_DEDUPE_ORIGINS:-https://social.occupymedia.cc}
       # Hub-as-OIDC-issuer signing keys (see docs/design/2026-10-13-files-oidc-sso.md).
       OIDC_KEY_DIR: /var/lib/tmbh/oidc
     volumes: