diff --git a/code-server/.env.example b/code-server/.env.example
index 0070ee4..8875be7 100644
--- a/code-server/.env.example
+++ b/code-server/.env.example
@@ -2,6 +2,10 @@
 #
 #   cp .env.example .env
 
+# Container hostname, also passed in as HOST -- the name zsh's prompt shows.
+# Not named HOSTNAME: the deploying shell's own HOSTNAME would override it.
+SERVICE_HOSTNAME=code-server
+
 # Web UI login password. MUST NOT be blank -- the LinuxServer image serves
 # code-server without authentication when PASSWORD is empty.
 # Also used for SUDO_PASSWORD inside the container.
diff --git a/code-server/README.md b/code-server/README.md
index 8ec4895..aa63fc3 100644
--- a/code-server/README.md
+++ b/code-server/README.md
@@ -25,11 +25,25 @@ because this is a single-user dev box.
 
 | Variable | Purpose |
 | --- | --- |
+| `SERVICE_HOSTNAME` | Container hostname, and the name the shell prompt shows. |
 | `PASSWORD` | Web UI login, also the in-container sudo password. **A blank value disables authentication entirely.** |
 | `GIT_NAME` / `GIT_EMAIL` | Git author and committer identity |
 
 Generate a password with `openssl rand -base64 24`.
 
+`SERVICE_HOSTNAME` is used twice: as the container's `hostname:` and as the
+`HOST` variable inside it. Coolify injects `HOST=0.0.0.0` into every compose
+app, and zsh seeds `$HOST` and the `%m`/`%M` prompt escapes from that variable
+rather than calling `gethostname()` -- so the prompt reads `0`, the first
+dot-separated field of `0.0.0.0`. code-server itself never reads `HOST` -- it
+binds `[::]:8443` -- so overriding it only affects the prompt. bash is
+unaffected; its `\h` uses the real hostname.
+
+It is not called `HOSTNAME`, the obvious name, because Compose interpolation
+lets the deploying shell's environment win over the `.env` file, and `HOSTNAME`
+is set in every container -- including the one Coolify itself runs in. The
+container would silently take Coolify's hostname instead of this value.
+
 ## Networking
 
 Listens on `8443`. No ports are published — point the domain at that port in
diff --git a/code-server/compose.yml b/code-server/compose.yml
index 09f30f4..c7cd642 100644
--- a/code-server/compose.yml
+++ b/code-server/compose.yml
@@ -1,11 +1,13 @@
 services:
   code-server:
     image: 'lscr.io/linuxserver/code-server:latest'
-    hostname: miti99-cs
+    hostname: ${SERVICE_HOSTNAME}
     environment:
       - PUID=1000
       - PGID=1000
       - TZ=Asia/Ho_Chi_Minh
+      # Hostname zsh's prompt reads, overriding the one Coolify injects.
+      - HOST=${SERVICE_HOSTNAME}
       - DEFAULT_WORKSPACE=/config/workspace
       - PWA_APPNAME=code-server
       - 'DOCKER_MODS=linuxserver/mods:universal-package-install|linuxserver/mods:universal-docker|linuxserver/mods:code-server-golang|linuxserver/mods:code-server-nodejs|linuxserver/mods:code-server-npmglobal|linuxserver/mods:code-server-pnpm|linuxserver/mods:code-server-python3|linuxserver/mods:code-server-zsh'
diff --git a/paseo/.env.example b/paseo/.env.example
index be96a0d..1f9737b 100644
--- a/paseo/.env.example
+++ b/paseo/.env.example
@@ -18,8 +18,10 @@ PASEO_HOSTNAMES=
 PASEO_TRUSTED_PROXIES=uniquelocal
 
 # Container hostname, shown as the host label in the web UI. Without it the
-# label is a random container ID.
-PASEO_LABEL=paseo
+# label is a random container ID. Also passed in as HOST -- the name zsh's
+# prompt shows. Not named HOSTNAME: the deploying shell's own HOSTNAME would
+# override it.
+SERVICE_HOSTNAME=paseo
 
 # Agent CLIs to install on start, if not already present. Space- or
 # comma-separated, from: claude codex opencode copilot omp pi. Leave empty to
@@ -32,8 +34,8 @@ TZ=Asia/Ho_Chi_Minh
 
 # Git identity for agents and terminals, as author and committer. git reads
 # these directly, so no `git config` step is needed.
-GIT_NAME=tiennm99
-GIT_EMAIL=tiennm99@outlook.com
+GIT_NAME=
+GIT_EMAIL=
 
 # Shell for Paseo's terminals. Paseo reads $SHELL and otherwise falls back to
 # /bin/sh (dash); it ignores the user's login shell, so `chsh` has no effect.
diff --git a/paseo/README.md b/paseo/README.md
index e74444f..09a29d0 100644
--- a/paseo/README.md
+++ b/paseo/README.md
@@ -39,11 +39,28 @@ the old entry is cached in `localStorage`.
 | `PASEO_HOSTNAMES` | Domains allowed to reach the daemon, comma-separated. Your domain must be listed. |
 | `PASEO_TRUSTED_PROXIES` | Set to `uniquelocal`, or the UI loads but never connects. |
 | `AGENT_CLIS` | Agent CLIs to install on start if missing, space- or comma-separated. Empty installs none. See [Agents](#agents). |
-| `PASEO_LABEL` | Container hostname, shown as the host label in the UI. Without it the label is a random container ID. |
+| `SERVICE_HOSTNAME` | Container hostname, shown as the host label in the UI and in the shell prompt. Without it the label is a random container ID. |
 | `GIT_NAME` / `GIT_EMAIL` | Git author and committer identity for agents and terminals. |
 | `TZ` | Timezone for logs and agent shells. |
 | `SHELL` | Shell for Paseo's terminals. Paseo reads `$SHELL` and falls back to `/bin/sh`, ignoring the login shell, so `chsh` has no effect. |
 
+`SERVICE_HOSTNAME` is used twice: as the container's `hostname:` and as the
+`HOST` variable inside it. Coolify injects `HOST=0.0.0.0` into every compose
+app, and zsh seeds `$HOST` and the `%m`/`%M` prompt escapes from that variable
+rather than calling `gethostname()` -- so the prompt reads `0`, the first
+dot-separated field of `0.0.0.0`. Paseo itself never reads `HOST` -- it binds
+`PASEO_LISTEN` -- so overriding it only affects the prompt. bash is
+unaffected; its `\h` uses the real hostname.
+
+It is not called `HOSTNAME`, the obvious name, because Compose interpolation
+lets the deploying shell's environment win over the `.env` file, and `HOSTNAME`
+is set in every container -- including the one Coolify itself runs in. The
+container would silently take Coolify's hostname instead of this value.
+
+`PASEO_LABEL` was this variable's old name. It was never a Paseo variable,
+only ours -- the daemon reads none of `PASEO_LABEL`, `SERVICE_HOSTNAME` or
+`HOST`, and takes the host label from the container hostname.
+
 `PASEO_TRUSTED_PROXIES` matches the proxy's *source IP*, so hostnames are
 rejected. The daemon trusts `X-Forwarded-Proto` from loopback only, but
 Coolify's Traefik reaches it from the Docker bridge network — so it reads the
diff --git a/paseo/compose.yml b/paseo/compose.yml
index b3001d9..21b0c45 100644
--- a/paseo/compose.yml
+++ b/paseo/compose.yml
@@ -1,9 +1,11 @@
 services:
   paseo:
     build: .
-    hostname: ${PASEO_LABEL}
+    hostname: ${SERVICE_HOSTNAME}
     environment:
       - TZ=${TZ}
+      # Hostname zsh's prompt reads, overriding the one Coolify injects.
+      - HOST=${SERVICE_HOSTNAME}
       - SHELL=${SHELL}
       - PASEO_PASSWORD=${PASEO_PASSWORD}
       - PASEO_HOSTNAMES=${PASEO_HOSTNAMES}