diff --git a/README.md b/README.md
index 266b33baf..7dc3cdaaf 100644
--- a/README.md
+++ b/README.md
@@ -43,7 +43,7 @@ To target a single package, filter by its name: `bun --filter=web-wallet run <sc
 
 ## Development
 
-1. Create `.env` file:
+1. Create the app `.env` file:
 
 ```sh
 cp apps/web-wallet/.env.example apps/web-wallet/.env
@@ -51,13 +51,24 @@ cp apps/web-wallet/.env.example apps/web-wallet/.env
 
 If needed, update the `apps/web-wallet/.env` file with alternative values. This file is ignored by git and used only for local development.
 
-2. Start Supabase local stack:
+2. Create the Supabase `.env` file:
+
+The local Supabase stack serves its API over HTTPS using the self-signed certificate. The Supabase CLI reads its environment variables from its own directory — not from `apps/web-wallet/.env` — so the certificate paths have to be provided separately. Create `packages/wallet-sdk/db/supabase/.env` with:
+
+```sh
+SELF_SIGNED_CERT_PATH='../../../../certs/localhost-cert.pem'
+SELF_SIGNED_CERT_KEY_PATH='../../../../certs/localhost-key.pem'
+```
+
+The paths are relative to `packages/wallet-sdk/db/supabase/` (where `config.toml` lives). This file is ignored by git and is also where any local Supabase secrets referenced from `config.toml` (e.g. `OPENAI_API_KEY`, `S3_ACCESS_KEY`) belong.
+
+3. Start Supabase local stack:
 
 ```sh
 bun run supabase start
 ```
 
-3. Run the dev server:
+4. Run the dev server:
 
 ```sh
 bun run dev
diff --git a/apps/web-wallet-e2e/.env.test b/apps/web-wallet-e2e/.env.test
index 567fe89fe..6d72f0bb1 100644
--- a/apps/web-wallet-e2e/.env.test
+++ b/apps/web-wallet-e2e/.env.test
@@ -8,8 +8,6 @@ VITE_SENTRY_HOST='o4509706567680000.ingest.us.sentry.io'
 VITE_SENTRY_PROJECT_ID='4509707316690944'
 VITE_SENTRY_DSN='https://3e5837ba4db251e806915155170ef71b@${VITE_SENTRY_HOST}/${VITE_SENTRY_PROJECT_ID}'
 VITE_ENVIRONMENT='local'
-SELF_SIGNED_CERT_PATH='../../../../certs/localhost-cert.pem'
-SELF_SIGNED_CERT_KEY_PATH='../../../../certs/localhost-key.pem'
 NODE_TLS_REJECT_UNAUTHORIZED=0
 LNURL_SERVER_SPARK_MNEMONIC='half vanish taxi again drill detail neglect park harsh setup involve dawn'
 LNURL_SERVER_ENCRYPTION_KEY="a8861cc3e5b3caf5573fbba2da2851a4e608a836eef10074be36ae0ca147b518"
diff --git a/apps/web-wallet/.env.example b/apps/web-wallet/.env.example
index 003e35faf..5da87c5d3 100644
--- a/apps/web-wallet/.env.example
+++ b/apps/web-wallet/.env.example
@@ -10,8 +10,6 @@ VITE_SENTRY_HOST='o4509706567680000.ingest.us.sentry.io'
 VITE_SENTRY_PROJECT_ID='4509707316690944'
 VITE_SENTRY_DSN='https://3e5837ba4db251e806915155170ef71b@${VITE_SENTRY_HOST}/${VITE_SENTRY_PROJECT_ID}'
 VITE_ENVIRONMENT='local'
-SELF_SIGNED_CERT_PATH='../../../certs/localhost-cert.pem'
-SELF_SIGNED_CERT_KEY_PATH='../../../certs/localhost-key.pem'
 NODE_TLS_REJECT_UNAUTHORIZED=0
 LNURL_SERVER_SPARK_MNEMONIC='half vanish taxi again drill detail neglect park harsh setup involve dawn'
 LNURL_SERVER_ENCRYPTION_KEY="a8861cc3e5b3caf5573fbba2da2851a4e608a836eef10074be36ae0ca147b518"