diff --git a/.env.example b/.env.example
index 55423d4136..f5014c405c 100644
--- a/.env.example
+++ b/.env.example
@@ -164,7 +164,8 @@ GITTENSORY_REVIEW_DRAFT=false
 #
 # RECOMMENDED over pasting secret values into this file at all: docker-compose.yml's native `secrets:`
 # mounts (secrets/README.md) cover the Core secrets above plus TOKEN_ENCRYPTION_SECRET,
-# DRAFT_TOKEN_ENCRYPTION_SECRET, SELFHOST_SETUP_TOKEN, ORB_ENROLLMENT_SECRET, and PAGERDUTY_ROUTING_KEY.
+# DRAFT_TOKEN_ENCRYPTION_SECRET, SELFHOST_SETUP_TOKEN, ORB_ENROLLMENT_SECRET, PAGERDUTY_ROUTING_KEY,
+# and CLAUDE_CODE_OAUTH_TOKEN.
 # Run `./scripts/selfhost-init-secrets.sh` once, then write each real value into its file under secrets/
 # instead of uncommenting the var here — an inline .env value always takes priority if you set both, so
 # migrating is safe to do one secret at a time.
diff --git a/docker-compose.yml b/docker-compose.yml
index b54a92fea2..1e6f8c367d 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -130,6 +130,7 @@ services:
       DRAFT_TOKEN_ENCRYPTION_SECRET_FILE: "${DRAFT_TOKEN_ENCRYPTION_SECRET_FILE:-/run/secrets/draft_token_encryption_secret}"
       ORB_ENROLLMENT_SECRET_FILE: "${ORB_ENROLLMENT_SECRET_FILE:-/run/secrets/orb_enrollment_secret}"
       PAGERDUTY_ROUTING_KEY_FILE: "${PAGERDUTY_ROUTING_KEY_FILE:-/run/secrets/pagerduty_routing_key}"
+      CLAUDE_CODE_OAUTH_TOKEN_FILE: "${CLAUDE_CODE_OAUTH_TOKEN_FILE:-/run/secrets/claude_code_oauth_token}"
       # Uncomment for Qdrant RAG vector store (--profile qdrant):
       # QDRANT_URL: http://qdrant:6333
       # Uncomment for Ollama AI (--profile ollama):
@@ -169,6 +170,7 @@ services:
       - draft_token_encryption_secret
       - orb_enrollment_secret
       - pagerduty_routing_key
+      - claude_code_oauth_token
     depends_on:
       redis:
         condition: service_healthy
@@ -1004,6 +1006,8 @@ secrets:
     file: ./secrets/orb_enrollment_secret.txt
   pagerduty_routing_key:
     file: ./secrets/pagerduty_routing_key.txt
+  claude_code_oauth_token:
+    file: ./secrets/claude_code_oauth_token.txt
 
 volumes:
   gittensory-data:
diff --git a/scripts/selfhost-init-secrets.sh b/scripts/selfhost-init-secrets.sh
index 0e6ea04b61..4a6175895f 100755
--- a/scripts/selfhost-init-secrets.sh
+++ b/scripts/selfhost-init-secrets.sh
@@ -42,6 +42,7 @@ SECRET_FILES=(
   "draft_token_encryption_secret.txt"
   "orb_enrollment_secret.txt"
   "pagerduty_routing_key.txt"
+  "claude_code_oauth_token.txt"
 )
 
 mkdir -p "$SECRETS_DIR"
diff --git a/secrets/README.md b/secrets/README.md
index ab786c6970..16276adc9a 100644
--- a/secrets/README.md
+++ b/secrets/README.md
@@ -66,6 +66,7 @@ see the tradeoff explained above for why `600` breaks the app's own ability to r
 | `draft_token_encryption_secret.txt` | `DRAFT_TOKEN_ENCRYPTION_SECRET_FILE` | AES-256-GCM secret for the contributor OAuth token (draft flow). |
 | `orb_enrollment_secret.txt` | `ORB_ENROLLMENT_SECRET_FILE` | One-time enrollment secret for brokered Orb mode. |
 | `pagerduty_routing_key.txt` | `PAGERDUTY_ROUTING_KEY_FILE` | PagerDuty Events API v2 routing key (experimental paging integration). |
+| `claude_code_oauth_token.txt` | `CLAUDE_CODE_OAUTH_TOKEN_FILE` | Claude Code subscription OAuth token (from `claude setup-token`), used when `AI_PROVIDER=claude-code`. |
 
 This is not the full list of every secret-shaped env var the stack supports (AI provider API keys,
 Discord/Slack webhooks, Postgres/Grafana credentials for their optional profiles, etc.) — it covers