diff --git a/backend/app/services/approval_task_links.py b/backend/app/services/approval_task_links.py
index 8013ad4a..595cabd3 100644
--- a/backend/app/services/approval_task_links.py
+++ b/backend/app/services/approval_task_links.py
@@ -266,9 +266,8 @@ async def task_counts_for_board(
     for legacy_task_id, total, pending in list(await session.exec(legacy_statement)):
         if legacy_task_id is None:
             continue
-        task_uuid = legacy_task_id
-        previous = counts.get(task_uuid, (0, 0))
-        counts[task_uuid] = (
+        previous = counts.get(legacy_task_id, (0, 0))
+        counts[legacy_task_id] = (
             previous[0] + int(total or 0),
             previous[1] + int(pending or 0),
         )
diff --git a/docs/operations/README.md b/docs/operations/README.md
index 9dbfcfa9..42546271 100644
--- a/docs/operations/README.md
+++ b/docs/operations/README.md
@@ -39,11 +39,15 @@ The DB runs in Postgres (Compose `db` service) and persists to the `postgres_dat
 Example with `pg_dump` (run on the host):
 
 ```bash
-# uses values from .env
-export POSTGRES_DB=mission_control
-export POSTGRES_USER=postgres
-export POSTGRES_PASSWORD=postgres
-export POSTGRES_PORT=5432
+# load variables from .env (trusted file only)
+set -a
+. ./.env
+set +a
+
+: "${POSTGRES_DB:?set POSTGRES_DB in .env}"
+: "${POSTGRES_USER:?set POSTGRES_USER in .env}"
+: "${POSTGRES_PORT:?set POSTGRES_PORT in .env}"
+: "${POSTGRES_PASSWORD:?set POSTGRES_PASSWORD in .env (strong, unique value; not \"postgres\")}"
 
 PGPASSWORD="$POSTGRES_PASSWORD" pg_dump \
   -h 127.0.0.1 -p "$POSTGRES_PORT" -U "$POSTGRES_USER" \