diff --git a/docker/php/php.ini b/docker/php/php.ini
index afed12e..19fb20b 100644
--- a/docker/php/php.ini
+++ b/docker/php/php.ini
@@ -1,6 +1,23 @@
+; --- Error handling (verbose for development) ---
 display_errors=1
 display_startup_errors=1
 error_reporting=E_ALL
+log_errors=1
+
+; --- Resource limits ---
 memory_limit=256M
 upload_max_filesize=10M
 post_max_size=12M
+
+; --- Security hardening (match prod to catch issues early) ---
+expose_php=Off
+allow_url_include=Off
+open_basedir=/var/www:/tmp
+disable_functions=exec,passthru,shell_exec,system,proc_open,popen,parse_ini_file,show_source
+
+; --- Session hardening ---
+session.use_strict_mode=1
+session.cookie_httponly=1
+session.cookie_samesite=Lax
+session.use_only_cookies=1
+session.use_trans_sid=0
diff --git a/docker/php/php.prod.ini b/docker/php/php.prod.ini
index 149ac5e..4054d3d 100644
--- a/docker/php/php.prod.ini
+++ b/docker/php/php.prod.ini
@@ -22,5 +22,3 @@ session.cookie_secure=1
 session.cookie_samesite=Lax
 session.use_only_cookies=1
 session.use_trans_sid=0
-session.sid_length=48
-session.sid_bits_per_character=6