diff --git a/lib/generators.sh b/lib/generators.sh
index 6925d16..58c7dbf 100644
--- a/lib/generators.sh
+++ b/lib/generators.sh
@@ -39,7 +39,7 @@ try:
     ci = cfg.get('ci', {})
     wp_id = ci.get('woodpecker_repo_id', '0')
     print(wp_id)
-except:
+except Exception:
     print('0')
 " "$toml_file" 2>/dev/null || echo "0"
   else
@@ -235,7 +235,7 @@ _generate_compose_impl() {
   local wp_repo_id
   wp_repo_id=$(_get_primary_woodpecker_repo_id)
 
-  cat > "$compose_file" <<COMPOSEEOF_VAR
+  cat > "$compose_file" <<'COMPOSEEOF'
 # docker-compose.yml — generated by disinto init
 # Brings up Forgejo, Woodpecker, and the agent runtime.
 
@@ -341,7 +341,7 @@ services:
       DISINTO_CONTAINER: "1"
       PROJECT_REPO_ROOT: /home/agent/repos/${PROJECT_NAME:-project}
       WOODPECKER_DATA_DIR: /woodpecker-data
-      WOODPECKER_REPO_ID: "${WP_REPO_ID:-}"
+      WOODPECKER_REPO_ID: "PLACEHOLDER_WP_REPO_ID"
     # IMPORTANT: agents get explicit environment variables (forge tokens, CI tokens, config).
     # Vault-only secrets (GITHUB_TOKEN, CLAWHUB_TOKEN, deploy keys) live in
     # .env.vault.enc and are NEVER injected here — only the runner
@@ -438,12 +438,21 @@ volumes:
 networks:
   disinto-net:
     driver: bridge
-COMPOSEEOF_VAR
+COMPOSEEOF
 
   # Patch PROJECT_REPO_ROOT — interpolate PROJECT_NAME at generation time
   # (Docker Compose cannot resolve it; it's a shell variable, not a .env var)
   sed -i "s|\${PROJECT_NAME:-project}|${PROJECT_NAME}|g" "$compose_file"
 
+  # Patch WOODPECKER_REPO_ID — interpolate at generation time
+  # (Docker Compose cannot resolve it; it's a shell variable, not a .env var)
+  if [ -n "$wp_repo_id" ] && [ "$wp_repo_id" != "0" ]; then
+    sed -i "s|PLACEHOLDER_WP_REPO_ID|${wp_repo_id}|g" "$compose_file"
+  else
+    # Default to empty if no repo_id found (agents will handle gracefully)
+    sed -i "s|PLACEHOLDER_WP_REPO_ID||g" "$compose_file"
+  fi
+
   # Patch the forgejo port mapping into the file if non-default
   if [ "$forge_port" != "3000" ]; then
     # Add port mapping to forgejo service so it's reachable from host during init