diff --git a/README.md b/README.md
index b8e84440..26e61e13 100644
--- a/README.md
+++ b/README.md
@@ -23,7 +23,8 @@
 ## MongoDB
 
 - Preferred: set a full `MONGO_URL` (example: `mongodb://user:pass@host:27017/indiekit?authSource=admin`).
-- If `MONGO_URL` is not set, config builds the URL from `MONGO_USERNAME`, `MONGO_PASSWORD`, `MONGO_HOST`, `MONGO_PORT`, `MONGO_DATABASE`, `MONGO_AUTH_SOURCE`.
+- If `MONGO_URL` is not set, set `MONGO_USERNAME` and `MONGO_PASSWORD` explicitly; config builds the URL from `MONGO_USERNAME`, `MONGO_PASSWORD`, `MONGO_HOST`, `MONGO_PORT`, `MONGO_DATABASE`, `MONGO_AUTH_SOURCE`.
+- Startup scripts now fail fast when `MONGO_URL` is absent and `MONGO_USERNAME` is missing, to avoid silent auth mismatches.
 - For `MongoServerError: Authentication failed`, first verify `MONGO_PASSWORD`, then try `MONGO_AUTH_SOURCE=admin`.
 
 ## Content paths
diff --git a/indiekit.config.mjs b/indiekit.config.mjs
index 24d13d39..9bce4d68 100644
--- a/indiekit.config.mjs
+++ b/indiekit.config.mjs
@@ -1,7 +1,6 @@
 import "dotenv/config";
 
-const mongoUsername =
-  process.env.MONGO_USERNAME || process.env.MONGO_USER || "indiekit";
+const mongoUsername = process.env.MONGO_USERNAME || process.env.MONGO_USER || "";
 const mongoPassword = process.env.MONGO_PASSWORD || "";
 const mongoHost = process.env.MONGO_HOST || "10.100.0.20";
 const mongoPort = process.env.MONGO_PORT || "27017";
diff --git a/start.example.sh b/start.example.sh
index c609f797..c048e3ed 100644
--- a/start.example.sh
+++ b/start.example.sh
@@ -22,8 +22,8 @@ fi
 
 # Allow either full Mongo URL or decomposed credentials.
 if [ -z "${MONGO_URL:-}" ]; then
+  : "${MONGO_USERNAME:?MONGO_USERNAME is required when MONGO_URL is not set}"
   : "${MONGO_PASSWORD:?MONGO_PASSWORD is required when MONGO_URL is not set}"
-  export MONGO_USERNAME="${MONGO_USERNAME:-indiekit}"
   export MONGO_AUTH_SOURCE="${MONGO_AUTH_SOURCE:-admin}"
 fi