diff --git a/CHANGELOG.md b/CHANGELOG.md
index f85bfe3da..7633a36e2 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -25,6 +25,7 @@
 - Gateway/WebChat: include handshake validation details in the WebSocket close reason for easier debugging.
 - Gateway/Auth: send invalid connect responses before closing the handshake; stabilize invalid-connect auth test.
 - Doctor: surface plugin diagnostics in the report.
+- Docker: tolerate unset optional env vars in docker-setup.sh under strict mode. (#725) — thanks @petradonka.
 - CLI/Update: preserve base environment when passing overrides to update subprocesses. (#713) — thanks @danielz1z.
 - Agents: treat message tool errors as failures so fallback replies still send; require `to` + `message` for `action=send`. (#717) — thanks @theglove44.
 - Agents: route subagent transcripts to the target agent sessions directory and add regression coverage. (#708) — thanks @xMikeMickelson.
diff --git a/docker-setup.sh b/docker-setup.sh
index 3e7164d26..776541827 100755
--- a/docker-setup.sh
+++ b/docker-setup.sh
@@ -132,7 +132,7 @@ upsert_env() {
       local replaced=false
       for k in "${keys[@]}"; do
         if [[ "$key" == "$k" ]]; then
-          printf '%s=%s\n' "$k" "${!k}" >>"$tmp"
+          printf '%s=%s\n' "$k" "${!k-}" >>"$tmp"
           seen["$k"]=1
           replaced=true
           break
@@ -146,7 +146,7 @@ upsert_env() {
 
   for k in "${keys[@]}"; do
     if [[ -z "${seen[$k]:-}" ]]; then
-      printf '%s=%s\n' "$k" "${!k}" >>"$tmp"
+      printf '%s=%s\n' "$k" "${!k-}" >>"$tmp"
     fi
   done