diff --git a/docker-compose.yml b/docker-compose.yml
index 430982e..a7455e7 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -103,6 +103,10 @@ services:
       - TOKEN_ENCRYPTION_KEY=ESF1BvEQdGYsCluwMx9Cxvw3uh5pFowPH7Rg_nIliyo=
       - TOKEN_STORAGE_DB=/app/data/tokens.db
 
+      # ADR-004: Use Hybrid Flow (server intercepts OAuth callback)
+      # Set to false to enable Hybrid Flow tests - server stores refresh token and issues MCP codes
+      - ENABLE_PROGRESSIVE_CONSENT=false
+
       # NO admin credentials - using OAuth with Dynamic Client Registration (DCR)
       # Client credentials registered via RFC 7591 and stored in volume
       # JWT token type is used for testing (faster validation, scopes embedded in token)