diff --git a/docs/provisioning.md b/docs/provisioning.md
index ac430e8..4bd1af8 100644
--- a/docs/provisioning.md
+++ b/docs/provisioning.md
@@ -118,8 +118,17 @@ Reconciliation is **converging, never destructive**:
 
 Nothing sensitive enters the spec or the resolved state. Both are committed.
 
-Paths are computed as `<mount>/fluid-telegram/<campaign>/telegram/<key>`, so two
-campaigns on one interface cannot read each other's credentials.
+Paths are `<mount>/<prefix>/<key>`, set by `BAO_MOUNT` and `FLUID_BAO_PREFIX`.
+The default (`secret/fluid-telegram/<campaign>/telegram`) is a development
+fallback, and the campaign is part of it so that two campaigns on one interface
+cannot read each other's credentials.
+
+**This repository does not get to invent the fleet's secret layout.** ops-warden
+routes API-key needs to railiance-platform, whose convention is
+`platform/workloads/<domain>/<workload>/<bundle>` — see
+`ops-warden/wiki/CredentialRouting.md`. The final names are owner-confirmed, so
+they are configuration here rather than a constant, and the production values
+are settled with railiance-platform before the first apply.
 
 | Secret | Key | Rule |
 |---|---|---|
diff --git a/docs/seeding-runbook.md b/docs/seeding-runbook.md
index 5343c3d..20759ec 100644
--- a/docs/seeding-runbook.md
+++ b/docs/seeding-runbook.md
@@ -73,7 +73,24 @@ secret/fluid-telegram/hall-of-helix/telegram/bot-token          written by the t
 secret/fluid-telegram/hall-of-helix/telegram/redaction-salt     written by the tool, once
 ```
 
-Set these before any command below. `BAO_MOUNT` defaults to `secret`.
+Those are the **development defaults**. The fleet convention for an API-key
+bundle is `platform/workloads/<domain>/<workload>/<bundle>`, owned by
+railiance-platform; ask ops-warden for the current shape and override it:
+
+```bash
+export BAO_MOUNT=platform
+export FLUID_BAO_PREFIX=workloads/infotech/fluid-telegram
+```
+
+Authenticate the way ops-warden routes you, which is OIDC through key-cape
+rather than a plain token login:
+
+```bash
+warden access 'openbao token for reading a kv secret'   # shows auth, path, policy
+bao login -method=oidc role=<domain>
+```
+
+`bao token lookup` succeeding is the check that the login actually took.
 
 ```bash
 export BAO_ADDR=https://bao.coulomb.social
diff --git a/internal/secrets/secrets.go b/internal/secrets/secrets.go
index d8414e3..f66cba8 100644
--- a/internal/secrets/secrets.go
+++ b/internal/secrets/secrets.go
@@ -54,12 +54,19 @@ func NewFromEnv(campaign string) (*Store, error) {
 		return nil, fmt.Errorf("no OpenBao token: set BAO_TOKEN, or run `bao login` "+
 			"to write ~/.vault-token (BAO_ADDR is %s)", addr)
 	}
+	// Mount and prefix are configurable because this repo does not get to invent
+	// the fleet's secret layout. ops-warden routes API-key needs to
+	// railiance-platform, whose convention is
+	// platform/workloads/<domain>/<workload>/<bundle> -- see
+	// ops-warden/wiki/CredentialRouting.md. The defaults below are a local
+	// fallback for development, not the intended production location.
 	mount := firstNonEmpty(os.Getenv("BAO_MOUNT"), "secret")
+	prefix := firstNonEmpty(os.Getenv("FLUID_BAO_PREFIX"), "fluid-telegram/"+campaign+"/telegram")
 	return &Store{
 		addr:   strings.TrimSuffix(addr, "/"),
 		token:  token,
 		mount:  mount,
-		prefix: "fluid-telegram/" + campaign + "/telegram",
+		prefix: strings.Trim(prefix, "/"),
 		hc:     &http.Client{Timeout: 20 * time.Second},
 	}, nil
 }