diff --git a/cmd/bot/main.go b/cmd/bot/main.go
index b5dbff5..3425a9f 100644
--- a/cmd/bot/main.go
+++ b/cmd/bot/main.go
@@ -105,7 +105,12 @@ func main() {
 	})
 
 	if err := client.Connect(cfg.BotUser, cfg.BotPass); err != nil {
-		log.Fatalf("Failed to connect: %v", err)
+		log.Printf("Failed to connect: %v", err)
+		if strings.Contains(err.Error(), "authentication failed") {
+			log.Println("Auth failure is permanent — exiting to prevent Docker restart loop")
+			os.Exit(0)
+		}
+		os.Exit(1)
 	}
 	defer client.Disconnect()
 
diff --git a/docker-compose.yml b/docker-compose.yml
index 3b36b7f..be2ed31 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -8,7 +8,7 @@ services:
         https_proxy: "${https_proxy:-}"
         no_proxy: "${no_proxy:-}"
     container_name: geekbot
-    restart: unless-stopped
+    restart: on-failure
     env_file: .env
     volumes:
       - bot-data:/data