diff --git a/docs/deploy/reuse-kubernetes.md b/docs/deploy/reuse-kubernetes.md
index 158001c..e92221b 100644
--- a/docs/deploy/reuse-kubernetes.md
+++ b/docs/deploy/reuse-kubernetes.md
@@ -16,11 +16,15 @@ docker push gitea.coulomb.social/coulomb/reuse-surface:<tag>
 | Variable | Purpose |
 |---|---|
 | `REUSE_SURFACE_TOKEN` | Bearer token for write API |
+| `REUSE_SURFACE_FORGEJO_WEBHOOK_SECRET` | HMAC for `POST /v1/webhooks/forgejo` |
 | `REUSE_SURFACE_DB` | SQLite path (default `/data/reuse.db`) |
 | `REUSE_SURFACE_CACHE_DIR` | Remote index cache (default `/data/cache`) |
 
-Mount a PVC at `/data` for persistence. Inject secrets via Kubernetes Secret
-`reuse-surface-env`.
+Mount a PVC at `/data` for persistence. Production injects secrets via
+`ExternalSecret reuse-surface-runtime` → Kubernetes Secret `reuse-surface-env`
+(OpenBao path `platform/workloads/reuse/reuse-surface/runtime-secrets`,
+CCR-2026-0005). Operator runbook: `railiance-apps/docs/reuse-surface-on-railiance01.md`;
+rotation: `railiance-platform/docs/reuse-surface-runtime-secrets-rotation-runbook.md`.
 
 ## Probes