diff --git a/services/metabase/docker-compose.yml.j2 b/services/metabase/docker-compose.yml.j2
index e6b2c15e..8dc0a4c4 100644
--- a/services/metabase/docker-compose.yml.j2
+++ b/services/metabase/docker-compose.yml.j2
@@ -23,8 +23,11 @@ services:
       - MB_DB_PASS=${METABASE_POSTGRES_PASSWORD}
       # https://www.metabase.com/docs/v0.54/installation-and-operation/running-metabase-on-docker#setting-the-java-timezone
       - JAVA_TIMEZONE=UTC
-      # https://www.metabase.com/docs/latest/installation-and-operation/observability-with-prometheus
+      # https://www.metabase.com/docs/v0.54/installation-and-operation/observability-with-prometheus
       - MB_PROMETHEUS_SERVER_PORT=9191
+      # https://www.metabase.com/docs/v0.54/people-and-groups/changing-password-complexity
+      - MB_PASSWORD_COMPLEXITY=strong
+      - MB_PASSWORD_LENGTH=20
     deploy:
       # https://www.metabase.com/learn/metabase-basics/administration/administration-and-operation/metabase-at-scale
       replicas: ${METABASE_REPLICAS}
@@ -49,7 +52,7 @@ services:
         - traefik.http.routers.metabase.entrypoints=https
         - traefik.http.routers.metabase.tls=true
         - traefik.http.middlewares.metabase_stripprefixregex.stripprefixregex.regex=^/metabase
-        - traefik.http.routers.metabase.middlewares=ops_whitelist_ips@swarm, ops_gzip@swarm, ops_auth@swarm, metabase_stripprefixregex
+        - traefik.http.routers.metabase.middlewares=ops_whitelist_ips@swarm, ops_gzip@swarm, metabase_stripprefixregex
         # service
         - traefik.http.services.metabase.loadbalancer.server.port=3000
         - traefik.http.services.metabase.loadbalancer.healthcheck.path=/api/health