diff --git a/CLAUDE.md b/CLAUDE.md
index f13241f..2ef4ad9 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -16,6 +16,7 @@ Recovery steps are in `RUNBOOK.md`. Repo overview and workflows are in `README.m
 - **Minecraft HTTP-only**: HTTPS causes WebSocket/CORS errors with the MCSManager daemon. No cert issued for this domain.
 - **SSL cert issuance chicken-and-egg**: On fresh recovery, certs don't exist so SSL confs can't load. The `.hold` pattern moves SSL confs aside, starts nginx with HTTP-only confs, issues certs, then restores SSL confs.
 - **SELinux is enforcing**: Caused issues with samba (symlinks blocked, parent directory traversal blocked). Don't use symlinks for config files — use the sync-system.sh copy approach instead.
+- **Secrets in .env files**: All secrets (DB passwords, API keys, tokens) live in `.env` files under each app's `docker/<app>/` directory on the server. These are gitignored (`**/.env` in root `.gitignore`). The `.env` files are included in the USB backup. If the backup is lost, all secrets can be recreated from Bitwarden. The `system/msmtprc` in the repo has its password REDACTED -- the real one is only on the server.
 - **ZFS parent dataset mountpoints**: Pools have parent datasets (e.g., `nextcloud`, `threeteras`) that create mountpoints like `/mnt/nextcloud`. These are empty and expected — do not delete them.
 - **msmtp**: Replaces sendmail for cron MAILTO and smartd email alerts. Configured via `/etc/msmtprc` (Fastmail SMTP). The symlink `/usr/sbin/sendmail -> /usr/bin/msmtp` is set up in recovery step 2.
 - **hantim-server**: Sister repo with similar nginx/certbot patterns. Located at `~/dev/hantim-server`. Useful as reference for deploy patterns.
diff --git a/README.md b/README.md
index 124b618..eed72d7 100644
--- a/README.md
+++ b/README.md
@@ -85,4 +85,5 @@ See [RUNBOOK.md](RUNBOOK.md) for full disaster recovery steps.
 | Nextcloud DB (PostgreSQL) | ZFS dataset + `pg_dumpall` + USB | `rsync` from USB |
 | Garage S3 data | 2-node replication + USB | Replication or USB |
 | Gitea repos + DB | SQLite `.backup` + USB | `rsync` from USB |
+| Secrets (.env files) | USB backup + Bitwarden | `rsync` from USB, or recreate from Bitwarden |
 | SSL certificates | Re-issued from Let's Encrypt | `./scripts/issue-cert.sh` |
diff --git a/RUNBOOK.md b/RUNBOOK.md
index 054cc5b..f5b5112 100644
--- a/RUNBOOK.md
+++ b/RUNBOOK.md
@@ -124,7 +124,21 @@ zpool status  # verify pools are ONLINE
 rsync -a /mnt/backup/argento/ /opt/argento/
 ```
 
-## 8. System configs
+## 8. Restore .env files
+
+Secrets are not in the repo -- they live in `.env` files on the server. Restore from USB backup:
+
+```bash
+# .env files are backed up alongside app data
+# After the rsync in step 7, they should already be in place. Verify:
+ls /opt/argento/docker/*/.env
+
+# If USB backup is unavailable (full from-scratch rebuild),
+# recreate .env files manually from Bitwarden.
+# Each app's compose.yaml or runner-config.yaml references its .env file.
+```
+
+## 9. System configs
 
 ```bash
 cp /opt/argento/system/docker-daemon.json /etc/docker/daemon.json
@@ -137,7 +151,7 @@ systemctl restart docker smb smartd
 crontab /opt/argento/system/root-crontab
 ```
 
-## 9. Nginx + SSL
+## 10. Nginx + SSL
 
 ```bash
 # Create shared network
@@ -177,7 +191,7 @@ systemctl enable --now certbot-renew.timer
 certbot renew --dry-run
 ```
 
-## 10. Docker apps
+## 11. Docker apps
 
 Deploy each app (nginx is already running and will return 502 until they start):
 
@@ -193,7 +207,7 @@ done
 docker ps  # verify all containers are healthy
 ```
 
-## 11. Router
+## 12. Router
 
 Set up port forwarding on the home router:
 
@@ -203,7 +217,7 @@ Set up port forwarding on the home router:
 - 3901 -> 192.168.2.122:3901 (Garage RPC)
 - 25500-25600 -> 192.168.2.122:25500-25600 (Minecraft)
 
-## 12. DNS
+## 13. DNS
 
 CNAME records pointing to the DDNS hostname. These don't need updating when the IP changes -- only the DDNS record does.
 
@@ -216,7 +230,7 @@ CNAME records pointing to the DDNS hostname. These don't need updating when the
 | `garage.timothykim.net` | CNAME | `argento.ddns.net` |
 | `minecraft.thekims.family` | CNAME | `argento.ddns.net` |
 
-## 13. Verify
+## 14. Verify
 
 ```bash
 curl -I https://nextcloud.timothykim.net