diff --git a/.env.sample b/.env.sample
index 56c1781..43ee9a7 100644
--- a/.env.sample
+++ b/.env.sample
@@ -47,11 +47,14 @@ SECRET_EMAIL_PASS_VERSION=v1
 # EMAIL_SUBJECT="Account Recovery"
 # EMAIL_TOKEN_EXPIRY_MINUTES=30
 
-## custom css and assets
+## assets
+COPY_ASSETS="flow_background.jpg|app:/web/dist/assets/images/"
+COPY_ASSETS="$COPY_ASSETS icon_left_brand.svg|app:/web/dist/assets/icons/"
+COPY_ASSETS="$COPY_ASSETS icon.png|app:/web/dist/assets/icons/"
+
+# store custom CSS in a css-volume
 #COMPOSE_FILE="$COMPOSE_FILE:compose.css-volume.yml"
-#COPY_ASSETS="flow_background.jpg|app:/web/dist/assets/images/"
-#COPY_ASSETS="$COPY_ASSETS icon_left_brand.svg|app:/web/dist/assets/icons/"
-#COPY_ASSETS="$COPY_ASSETS icon.png|app:/web/dist/assets/icons/"
+# NOTE: this causes the authentik container to run as `root` initially; it uses `su` to drop privileges but technically could introduce a security risk. proceed with caution!
 
 # Default CSS customisation
 # COMPOSE_FILE="$COMPOSE_FILE:compose.css.yml"