diff --git a/deployments/examples/ocis_keycloak/config/ocis/entrypoint-override.sh b/deployments/examples/ocis_keycloak/config/ocis/entrypoint-override.sh
index 65a1ed475..9e0a524ac 100644
--- a/deployments/examples/ocis_keycloak/config/ocis/entrypoint-override.sh
+++ b/deployments/examples/ocis_keycloak/config/ocis/entrypoint-override.sh
@@ -19,7 +19,7 @@ echo "  Reva user UUID: $REVA_USER_UUID"
 ocis accounts update --password $STORAGE_LDAP_BIND_PASSWORD $REVA_USER_UUID
 
 killall ocis
-echo "default serets changed"
+echo "default secrets changed"
 echo "##################################################"
 
 ocis server
diff --git a/deployments/examples/ocis_traefik/.env b/deployments/examples/ocis_traefik/.env
index 94906757f..a93b12e07 100644
--- a/deployments/examples/ocis_traefik/.env
+++ b/deployments/examples/ocis_traefik/.env
@@ -18,11 +18,11 @@ OCIS_DOCKER_TAG=
 # Domain of oCIS, where you can find the frontend. Defaults to "ocis.owncloud.test"
 OCIS_DOMAIN=
 # IDP LDAP bind password. Must be changed in order to have a secure oCIS. Defaults to "idp".
-IDP_LDAP_BIND_PASSWORD=
+IDP_LDAP_BIND_PASSWORD=foo
 # Storage LDAP bind password. Must be changed in order to have a secure oCIS. Defaults to "reva".
-STORAGE_LDAP_BIND_PASSWORD=
+STORAGE_LDAP_BIND_PASSWORD=foo
 # JWT secret which is used for the storage provider. Must be changed in order to have a secure oCIS. Defaults to "Pive-Fumkiu4"
-OCIS_JWT_SECRET=
+OCIS_JWT_SECRET=foo
 
 # If you want to use debugging and tracing with this stack,
 # you need uncomment following line. Please see documentation at
diff --git a/deployments/examples/ocis_traefik/config/ocis/entrypoint-override.sh b/deployments/examples/ocis_traefik/config/ocis/entrypoint-override.sh
index 65a1ed475..9e0a524ac 100644
--- a/deployments/examples/ocis_traefik/config/ocis/entrypoint-override.sh
+++ b/deployments/examples/ocis_traefik/config/ocis/entrypoint-override.sh
@@ -19,7 +19,7 @@ echo "  Reva user UUID: $REVA_USER_UUID"
 ocis accounts update --password $STORAGE_LDAP_BIND_PASSWORD $REVA_USER_UUID
 
 killall ocis
-echo "default serets changed"
+echo "default secrets changed"
 echo "##################################################"
 
 ocis server
diff --git a/docs/ocis/deployment/_index.md b/docs/ocis/deployment/_index.md
index 08e95760b..694c6dc2c 100644
--- a/docs/ocis/deployment/_index.md
+++ b/docs/ocis/deployment/_index.md
@@ -39,7 +39,7 @@ Both have simple default passwords which need to be changed. Currently, changing
 
 The new password for the Reva Inter Operability Platform user must be made available to oCIS by using the environment variable `STORAGE_LDAP_BIND_PASSWORD`. The same applies to the new Kopano IDP user password, which needs do be made available to oCIS in `IDP_LDAP_BIND_PASSWORD`.
 
-Furthermore oCIS needs to share a JWT token with REVA, which also need to be changed by the user.
+Furthermore, oCIS uses a shared secret to sign JWT tokens for inter service authorization, which also needs to be changed by the user.
 You can change it by setting the `OCIS_JWT_SECRET` environment variable for oCIS to a random string.
 
 ### Delete demo users
diff --git a/ocis/pkg/flagset/flagset.go b/ocis/pkg/flagset/flagset.go
index 00ba85897..8daa92c78 100644
--- a/ocis/pkg/flagset/flagset.go
+++ b/ocis/pkg/flagset/flagset.go
@@ -74,7 +74,7 @@ func RootWithConfig(cfg *config.Config) []cli.Flag {
 			Name:        "jwt-secret",
 			Value:       "Pive-Fumkiu4",
 			Usage:       "Used to dismantle the access token, should equal reva's jwt-secret",
-			EnvVars:     []string{"OCIS_JWT_SECRET", "OCIS_JWT_SECRET"},
+			EnvVars:     []string{"OCIS_JWT_SECRET"},
 			Destination: &cfg.TokenManager.JWTSecret,
 		},
 	}