diff --git a/docker-compose.yml b/docker-compose.yml
index 7264e78..87046ff 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -16,8 +16,11 @@ services:
       MEMORY: ${MC_MEMORY:-6G}
       USE_AIKAR_FLAGS: "true"
 
-      # Offline mode + whitelist as the approval gate (see docs/auth-flow.md)
+      # Offline mode + whitelist as the approval gate (see docs/auth-flow.md).
+      # enforce-secure-profile must be off or offline-launcher players are
+      # rejected before EasyAuth can even prompt them (EasyAuth issue #68).
       ONLINE_MODE: "FALSE"
+      ENFORCE_SECURE_PROFILE: "FALSE"
       ENABLE_WHITELIST: "TRUE"
       ENFORCE_WHITELIST: "TRUE"
 
diff --git a/docs/troubleshooting.md b/docs/troubleshooting.md
index 8b79daa..88c5aa4 100644
--- a/docs/troubleshooting.md
+++ b/docs/troubleshooting.md
@@ -20,12 +20,16 @@ Work down this list:
 1. **"Not whitelisted"** → their username isn't approved (or the window expired and
    auto-revoked them). Access & Auth → approve/re-open. Username must match **exactly**
    (case matters in TLauncher).
-2. **Joins but immediately kicked** → they didn't `/register` or `/login` in time —
+2. **Kicked with a "secure profile" / "invalid signature" style error** →
+   `enforce-secure-profile` must be `false` for offline launchers. The compose file
+   sets `ENFORCE_SECURE_PROFILE: "FALSE"`; if you edited `server.properties` by hand,
+   make sure `enforce-secure-profile=false`.
+3. **Joins but immediately kicked** → they didn't `/register` or `/login` in time —
    EasyAuth kicks unauthenticated players after a timeout. Tell them to type faster or
    raise the timeout in `config/EasyAuth/`.
-3. **"Connection timed out"** → networking: is 25565 port-forwarded? Are they using
+4. **"Connection timed out"** → networking: is 25565 port-forwarded? Are they using
    your *public* IP? Does `docker compose ps` show `mc` healthy?
-4. **Wrong password loop** → Access & Auth → **Reset password**, share the temporary
+5. **Wrong password loop** → Access & Auth → **Reset password**, share the temporary
    one privately.
 
 ## Panel shows "Offline" but the server is up