diff --git a/docs/deploy.md b/docs/deploy.md
index f1fd606..5834103 100644
--- a/docs/deploy.md
+++ b/docs/deploy.md
@@ -8,13 +8,26 @@ railiance01 (same lane as `vergabe-teilnahme`).
 
 ## Runtime secrets (names only)
 
-| Secret | Consumer |
-|--------|----------|
-| `SECRET_KEY` | Django |
-| `DATABASE_URL` | Django |
-| `OIDC_CLIENT_SECRET` | identity app |
-| future DB password | OpenBao dynamic/KV |
+K8s Secret `coulomb-social-env` in namespace `coulomb-social` (chart `envFrom`):
 
+| Key | Source |
+|-----|--------|
+| `SECRET_KEY` | generated by env-secret script |
+| `DATABASE_URL` | cnpg app role secret (URL-encoded password) |
+| `USER_ENGINE_PROXY_SECRET` | `user-engine/user-engine-runtime` |
+
+```bash
+# from railiance-apps:
+make coulomb-social-env-secret-dry-run
+make coulomb-social-env-secret
+
+# from this repo:
+./scripts/create-env-secret.sh --dry-run
+./scripts/create-env-secret.sh
+```
+
+Script: `railiance-apps/tools/create-coulomb-social-env-secret.sh`  
+OIDC is a **public** client — no client secret.
 ## Health
 
 - `GET /healthz` → `{"status":"ok"}`
diff --git a/docs/dev.md b/docs/dev.md
index a5956f0..1130d29 100644
--- a/docs/dev.md
+++ b/docs/dev.md
@@ -67,3 +67,14 @@ make run
 Sign-in redirects to Authelia (`auth.coulomb.social`) + MFA via privacyIDEA.
 
 See `docs/adr/ADR-0001-netkingdom-identity.md` and `docs/identity/`.
+
+### Cluster env Secret (production)
+
+```bash
+# dry-run (key names only)
+./scripts/create-env-secret.sh --dry-run
+# apply (needs kubectl + cluster access)
+./scripts/create-env-secret.sh
+```
+
+Delegates to `railiance-apps/tools/create-coulomb-social-env-secret.sh`.
diff --git a/scripts/create-env-secret.sh b/scripts/create-env-secret.sh
new file mode 100755
index 0000000..f0e38c9
--- /dev/null
+++ b/scripts/create-env-secret.sh
@@ -0,0 +1,10 @@
+#!/usr/bin/env bash
+# Thin wrapper: env-secret lives in railiance-apps (operator deploy surface).
+set -euo pipefail
+SCRIPT="${RAILIANCE_APPS_DIR:-$HOME/railiance-apps}/tools/create-coulomb-social-env-secret.sh"
+if [[ ! -f "$SCRIPT" ]]; then
+  echo "ERROR: not found: $SCRIPT" >&2
+  echo "Clone railiance-apps or set RAILIANCE_APPS_DIR." >&2
+  exit 1
+fi
+exec bash "$SCRIPT" "$@"