diff --git a/README.md b/README.md
index 54ebee6..8620a0b 100644
--- a/README.md
+++ b/README.md
@@ -75,6 +75,15 @@ Two services on one LXC, sharing one Claude Max OAuth subscription:
      -d '{"model":"claude-haiku-4-5","max_tokens":40,"messages":[{"role":"user","content":"reply with the single word: pong"}]}'
    ```
 
+## Secrets
+
+Pulled from Infisical at deploy time (`infisical.vault.read_secrets` in `site.yml`):
+
+**`/meridian/`**
+- `vault_litellm_master_key` — LiteLLM proxy master key (required; sanity-checked in `site.yml`)
+- `vault_openai_api_key` — OpenAI key for LiteLLM `direct_*` models (optional, `default('')`)
+- `vault_gemini_api_key` — Gemini key for LiteLLM `direct_*` models (optional, `default('')`)
+
 ## Wiring a client
 
 | Client type | Endpoint | Auth |