diff --git a/vars/main.yml b/vars/main.yml
index f4bb31a..43c6632 100644
--- a/vars/main.yml
+++ b/vars/main.yml
@@ -66,6 +66,19 @@ dawarich_sidekiq_concurrency: 5
 # when wired.
 # dawarich_photon_api_host: "photon.lan.balders.ca"
 
+# Immich integration (Dawarich ← Immich). Dawarich pulls GPS/EXIF from the
+# geotagged photos in Immich and plots them as map markers / location points.
+# NOT env-driven — current Dawarich configures this PER-USER in the web UI
+# (Settings → enter Immich URL + API key → Save; then Imports → "Import Immich
+# data", and enable the map's Photos layer). Recorded here for rebuild reference:
+#   - Immich URL (use the LAN HTTPS endpoint; direct http://192.168.1.157:2283
+#     also works and skips the Caddy hop):
+dawarich_immich_url: "https://immich.balders.ca"
+#   - API key: generate in Immich → Account Settings → API Keys with scopes
+#     asset.read + asset.view (+ asset.update only for the "Enrich Photos"
+#     write-back feature). Per-user, so it is NOT stored in Infisical — each
+#     user pastes their own key into the Dawarich Settings page.
+
 # OIDC via Authentik. Client id/secret live in Infisical /oidc/ (pushed into
 # Authentik by homelab-ansible-pi-auth's oidc_clients role).
 dawarich_oidc_enabled: true