diff --git a/compose.allocated-smoke.yml b/compose.allocated-smoke.yml
index 065d698c..6ebf40a7 100644
--- a/compose.allocated-smoke.yml
+++ b/compose.allocated-smoke.yml
@@ -58,7 +58,11 @@ services:
       COSMIC_CLASH_WORKLOAD_SECRET: compose-workload-secret
       COSMIC_CLASH_KUBERNETES_TOKEN_PATH: /run/cosmic-clash/kubernetes-token
       COSMIC_CLASH_KUBERNETES_CA_PATH: /run/cosmic-clash/fake-agones.crt
-    command: ["--dsn=postgres://cosmic_clash_test:cosmic_clash_test@database:5432/cosmic_clash_test?sslmode=disable", "--migrations=/opt/cosmic-clash/migrations", "--interval=1s", "--transport=enet"]
+    # The allocator signs one join authorisation per participant and publishes
+    # the assignment roster, so it needs the same key material the game server
+    # verifies with. It refuses to start without them rather than binding
+    # allocations that could never become joinable.
+    command: ["--dsn=postgres://cosmic_clash_test:cosmic_clash_test@database:5432/cosmic_clash_test?sslmode=disable", "--migrations=/opt/cosmic-clash/migrations", "--interval=1s", "--transport=enet", "--join-authorisations-key-file=/run/secrets/cosmic-clash/join-signing-keys.json", "--join-authorisations-key-id=compose-key-1"]
     depends_on:
       database:
         condition: service_healthy
@@ -67,6 +71,7 @@ services:
     volumes:
       - ${COMPOSE_SMOKE_DIR:-/tmp/cosmic-clash-allocated-smoke}/kubernetes-token:/run/cosmic-clash/kubernetes-token:ro
       - ${COMPOSE_SMOKE_DIR:-/tmp/cosmic-clash-allocated-smoke}/fake-agones.crt:/run/cosmic-clash/fake-agones.crt:ro
+      - ${COMPOSE_SMOKE_DIR:-/tmp/cosmic-clash-allocated-smoke}/join-signing-keys.json:/run/secrets/cosmic-clash/join-signing-keys.json:ro
 
   maintenance:
     build: