diff --git a/docs/remetrics-operations.md b/docs/remetrics-operations.md
index 74fd816..e33faf5 100644
--- a/docs/remetrics-operations.md
+++ b/docs/remetrics-operations.md
@@ -163,7 +163,8 @@ These are known differences between remetrics and how other services are configu
 1. **Cert resolver**: remetrics uses `cloudflare` (DNS-01) while all other services use `letsencrypt` (HTTP-01). This is intentional — DNS-01 was required for zero-downtime cutover cert pre-issue.
 2. **No HTTP→HTTPS redirect router**: remetrics has no explicit port-80 router with redirect middleware. Other services (e.g., BestSolarTech) define explicit HTTP routers. Whether Traefik's global `entrypoints.web.http.redirections` covers port-80 for remetrics.io is unverified — **open question**.
 3. **Restart policy**: `unless-stopped` (not `always`). Manual `docker stop` will not auto-restart the containers after a daemon restart until you run `docker compose up -d` again.
-4. **Secrets hardcoded in compose**: `POSTGRES_PASSWORD`, `SECRET_KEY_BASE`, and `OPENAI_API_KEY` are cleartext inline values in `~/services/remetrics/docker-compose.yml`. Moving these to a `.env` file is a prerequisite before the compose file can be checked into version control. See [remetrics Update Workflow](./remetrics-update-workflow.md).
+4. **Secrets in compose** — RESOLVED (2026-06-25): `POSTGRES_PASSWORD`, `SECRET_KEY_BASE`, and `OPENAI_API_KEY` were extracted from inline cleartext in `~/services/remetrics/docker-compose.yml` to a gitignored `~/services/remetrics/.env` (mode 600), referenced via `${VAR}` interpolation. Verified byte-identical resolved config; zero container disruption. Backup: `docker-compose.yml.bak-2026-06-25`. This matches house style. Note: `strapi-remetrics` already used `env_file: ./strapi/.env` — no change was needed there.
+   - **TODO (follow-up)**: The GCS service account JSON at `~/services/strapi-remetrics/strapi/gcs/gcs-service-account.json` should be rotated and stored in Vaultwarden as a file credential. This key predates the OVH migration and has not been rotated.
 5. **No healthchecks**: None of the remetrics containers define Docker healthchecks. `depends_on` runs without condition checks — the db may not be ready when Rails starts. In practice puma retries on boot, but this can cause slower start times.
 6. **Shared `internal` network**: The `internal` network (172.21.0.0/16) is shared server-wide. Any future service added to `internal` can reach remetrics Postgres (5432) and Redis (6379) by container DNS name. Redis has no password.
 
diff --git a/docs/remetrics-update-workflow.md b/docs/remetrics-update-workflow.md
index 58ebc35..3a280dc 100644
--- a/docs/remetrics-update-workflow.md
+++ b/docs/remetrics-update-workflow.md
@@ -40,11 +40,11 @@ Then set `IMAGE_TAG` in the environment before running `docker compose build`.
 
 This setup should be tested in a dry run (build only, no `up`) before the next time a real update is needed.
 
-### PREREQ 3: Move secrets out of compose (before any version control use)
+### ~~PREREQ 3: Move secrets out of compose~~ — DONE (2026-06-25)
 
-`POSTGRES_PASSWORD`, `SECRET_KEY_BASE`, and `OPENAI_API_KEY` are currently hardcoded as cleartext in `~/services/remetrics/docker-compose.yml`. If the compose file is ever committed to a git repo or synced to a remote, these secrets are exposed.
+`POSTGRES_PASSWORD`, `SECRET_KEY_BASE`, and `OPENAI_API_KEY` have been extracted from inline cleartext in `~/services/remetrics/docker-compose.yml` to a gitignored `~/services/remetrics/.env` (mode 600), referenced via `${VAR}` interpolation. Verified byte-identical resolved config; zero container disruption. Backup: `docker-compose.yml.bak-2026-06-25`.
 
-Move them to `~/services/remetrics/.env` and reference via `env_file:` or `${VAR}` substitution in the compose file. This step is required before pushing compose files to any registry or version control.
+Note: `strapi-remetrics` already used `env_file: ./strapi/.env` — its pattern was already correct; no change was needed there. The `~/services/remetrics/.env` file now EXISTS on the server.
 
 ### ~~PREREQ 4: Push current images to a registry (image safety net)~~ — DONE (2026-06-25)
 
@@ -125,13 +125,13 @@ Run migrations against the live database using a one-off container before cuttin
 ```bash
 docker run --rm \
   --network internal \
+  --env-file ~/services/remetrics/.env \
   -e RAILS_ENV=production \
-  -e DATABASE_URL=postgres://estatioro:PASSWORD@remetrics-db-1/remetrics_production \
   remetrics-web:production-$DATE \
   bundle exec rails db:migrate
 ```
 
-> **Note**: Replace `PASSWORD` with the actual value from `~/services/remetrics/docker-compose.yml`. Once PREREQ 3 is complete, this can use `--env-file ~/services/remetrics/.env` instead.
+> **Note**: `~/services/remetrics/.env` contains `POSTGRES_PASSWORD` and the other secrets — use `--env-file` to pass them without hardcoding values in the command. The `DATABASE_URL` is constructed from these vars inside the Rails app.
 
 If migrations fail, abort — existing containers are still running the old code on the old schema. Investigate and fix before retrying.