diff --git a/surfsense_web/app/(home)/login/LocalLoginForm.tsx b/surfsense_web/app/(home)/login/LocalLoginForm.tsx
index d632d09ed..62d2a2a66 100644
--- a/surfsense_web/app/(home)/login/LocalLoginForm.tsx
+++ b/surfsense_web/app/(home)/login/LocalLoginForm.tsx
@@ -9,6 +9,7 @@ import { useEffect, useState } from "react";
 import { toast } from "sonner";
 import { loginMutationAtom } from "@/atoms/auth/auth-mutation.atoms";
 import { getAuthErrorDetails, isNetworkError, shouldRetry } from "@/lib/auth-errors";
+import { AUTH_TYPE } from "@/lib/env-config";
 import { ValidationError } from "@/lib/error";
 import { trackLoginAttempt, trackLoginFailure, trackLoginSuccess } from "@/lib/posthog/events";
 
@@ -30,8 +31,8 @@ export function LocalLoginForm() {
 	const [{ mutateAsync: login, isPending: isLoggingIn }] = useAtom(loginMutationAtom);
 
 	useEffect(() => {
-		// Get the auth type from environment variables
-		setAuthType(process.env.NEXT_PUBLIC_FASTAPI_BACKEND_AUTH_TYPE || "GOOGLE");
+		// Get the auth type from centralized config
+		setAuthType(AUTH_TYPE);
 	}, []);
 
 	const handleSubmit = async (e: React.FormEvent) => {
diff --git a/surfsense_web/app/(home)/login/page.tsx b/surfsense_web/app/(home)/login/page.tsx
index e2577563f..7aade8427 100644
--- a/surfsense_web/app/(home)/login/page.tsx
+++ b/surfsense_web/app/(home)/login/page.tsx
@@ -8,6 +8,7 @@ import { Suspense, useEffect, useState } from "react";
 import { toast } from "sonner";
 import { Logo } from "@/components/Logo";
 import { getAuthErrorDetails, shouldRetry } from "@/lib/auth-errors";
+import { AUTH_TYPE } from "@/lib/env-config";
 import { AmbientBackground } from "./AmbientBackground";
 import { GoogleLoginButton } from "./GoogleLoginButton";
 import { LocalLoginForm } from "./LocalLoginForm";
@@ -82,8 +83,8 @@ function LoginContent() {
 			});
 		}
 
-		// Get the auth type from environment variables
-		setAuthType(process.env.NEXT_PUBLIC_FASTAPI_BACKEND_AUTH_TYPE || "GOOGLE");
+		// Get the auth type from centralized config
+		setAuthType(AUTH_TYPE);
 		setIsLoading(false);
 	}, [searchParams, t, tCommon]);
 
diff --git a/surfsense_web/app/(home)/register/page.tsx b/surfsense_web/app/(home)/register/page.tsx
index 724f7ee58..243ad4c60 100644
--- a/surfsense_web/app/(home)/register/page.tsx
+++ b/surfsense_web/app/(home)/register/page.tsx
@@ -10,6 +10,7 @@ import { toast } from "sonner";
 import { registerMutationAtom } from "@/atoms/auth/auth-mutation.atoms";
 import { Logo } from "@/components/Logo";
 import { getAuthErrorDetails, isNetworkError, shouldRetry } from "@/lib/auth-errors";
+import { AUTH_TYPE } from "@/lib/env-config";
 import { AppError, ValidationError } from "@/lib/error";
 import {
 	trackRegistrationAttempt,
@@ -36,8 +37,7 @@ export default function RegisterPage() {
 
 	// Check authentication type and redirect if not LOCAL
 	useEffect(() => {
-		const authType = process.env.NEXT_PUBLIC_FASTAPI_BACKEND_AUTH_TYPE || "GOOGLE";
-		if (authType !== "LOCAL") {
+		if (AUTH_TYPE !== "LOCAL") {
 			router.push("/login");
 		}
 	}, [router]);
diff --git a/surfsense_web/components/homepage/hero-section.tsx b/surfsense_web/components/homepage/hero-section.tsx
index a9cfdeba2..7ccdd850c 100644
--- a/surfsense_web/components/homepage/hero-section.tsx
+++ b/surfsense_web/components/homepage/hero-section.tsx
@@ -4,6 +4,7 @@ import Image from "next/image";
 import Link from "next/link";
 import React, { useEffect, useRef, useState } from "react";
 import Balancer from "react-wrap-balancer";
+import { AUTH_TYPE, BACKEND_URL } from "@/lib/env-config";
 import { trackLoginAttempt } from "@/lib/posthog/events";
 import { cn } from "@/lib/utils";
 
@@ -134,11 +135,11 @@ export function HeroSection() {
 }
 
 function GetStartedButton() {
-	const isGoogleAuth = process.env.NEXT_PUBLIC_FASTAPI_BACKEND_AUTH_TYPE === "GOOGLE";
+	const isGoogleAuth = AUTH_TYPE === "GOOGLE";
 
 	const handleGoogleLogin = () => {
 		trackLoginAttempt("google");
-		window.location.href = `${process.env.NEXT_PUBLIC_FASTAPI_BACKEND_URL}/auth/google/authorize-redirect`;
+		window.location.href = `${BACKEND_URL}/auth/google/authorize-redirect`;
 	};
 
 	if (isGoogleAuth) {
diff --git a/surfsense_web/lib/env-config.ts b/surfsense_web/lib/env-config.ts
new file mode 100644
index 000000000..5e35b160c
--- /dev/null
+++ b/surfsense_web/lib/env-config.ts
@@ -0,0 +1,28 @@
+/**
+ * Environment configuration for the frontend.
+ * 
+ * This file centralizes access to NEXT_PUBLIC_* environment variables.
+ * For Docker deployments, these placeholders are replaced at container startup
+ * via sed in the entrypoint script.
+ * 
+ * IMPORTANT: Do not use template literals or complex expressions with these values
+ * as it may prevent the sed replacement from working correctly.
+ */
+
+// Auth type: "LOCAL" for email/password, "GOOGLE" for OAuth
+// Placeholder: __NEXT_PUBLIC_FASTAPI_BACKEND_AUTH_TYPE__
+export const AUTH_TYPE = process.env.NEXT_PUBLIC_FASTAPI_BACKEND_AUTH_TYPE || "GOOGLE";
+
+// Backend API URL
+// Placeholder: __NEXT_PUBLIC_FASTAPI_BACKEND_URL__
+export const BACKEND_URL = process.env.NEXT_PUBLIC_FASTAPI_BACKEND_URL || "http://localhost:8000";
+
+// ETL Service: "DOCLING" or "UNSTRUCTURED"
+// Placeholder: __NEXT_PUBLIC_ETL_SERVICE__
+export const ETL_SERVICE = process.env.NEXT_PUBLIC_ETL_SERVICE || "DOCLING";
+
+// Helper to check if local auth is enabled
+export const isLocalAuth = () => AUTH_TYPE === "LOCAL";
+
+// Helper to check if Google auth is enabled  
+export const isGoogleAuth = () => AUTH_TYPE === "GOOGLE";