diff --git a/.env.example b/.env.example
index 999a299..6af5d90 100644
--- a/.env.example
+++ b/.env.example
@@ -30,7 +30,6 @@ GC_ACCESS_PROVIDER_YOUTUBE_CLIENT_ID=
 GC_ACCESS_PROVIDER_SPOTIFY_CLIENT_ID=
 # GC_ACCESS_PROVIDER_SPOTIFY_CLIENT_SECRET_FILE=/absolute/path/to/credential
 
-# GC_ACCESS_APP_SPOTIVERSE_SHARED_SECRET_FILE=/absolute/path/to/credential
 GC_ACCESS_APP_SPOTIVERSE_BACKEND_CALLBACK_URLS=
 # GC_ACCESS_APP_GHOSTLIGHT_SHARED_SECRET_FILE=/absolute/path/to/credential
 GC_ACCESS_APP_GHOSTLIGHT_RUNTIME_IDS=yggdrasil-ghostlight
diff --git a/docs/app-profiles/bifrost.md b/docs/app-profiles/bifrost.md
index 99d37b6..976452f 100644
--- a/docs/app-profiles/bifrost.md
+++ b/docs/app-profiles/bifrost.md
@@ -68,10 +68,11 @@ paid membership for the requested tier title, and POSTs a signed
 `RecurringSupportSnapshot` fact to Bifrost's
 `/heimdall/patron-support/events` endpoint.
 
-The outbound fact uses `X-Heimdall-Signature-256` with the shared
-`GC_ACCESS_BIFROST_PATRON_SUPPORT_SECRET`. Bifrost verifies that HMAC, resolves
-the Heimdall account id to its local user account, deduplicates by provider
-event id, records the support event, and derives patron points locally.
+The outbound fact uses `X-Heimdall-Signature-256` with the shared secret
+Heimdall reads from `GC_ACCESS_BIFROST_PATRON_SUPPORT_SECRET_FILE`. Bifrost
+verifies that HMAC, resolves the Heimdall account id to its local user account,
+deduplicates by provider event id, records the support event, and derives
+patron points locally.
 
 This route is a bridge from auth-owned Patreon evidence to Bifrost-owned
 governance meaning. Heimdall still does not own points, votes, tiers, ledger
diff --git a/docs/app-profiles/spotiverse.md b/docs/app-profiles/spotiverse.md
index 64a71eb..a10c72a 100644
--- a/docs/app-profiles/spotiverse.md
+++ b/docs/app-profiles/spotiverse.md
@@ -81,12 +81,11 @@ Heimdall needs:
 ```text
 GC_ACCESS_PROVIDER_SPOTIFY_CLIENT_ID=...
 GC_ACCESS_PROVIDER_SPOTIFY_CLIENT_SECRET_FILE=/absolute/path/to/spotify-client-secret
-GC_ACCESS_APP_SPOTIVERSE_SHARED_SECRET_FILE=/absolute/path/to/spotiverse-shared-secret
 GC_ACCESS_APP_SPOTIVERSE_BACKEND_CALLBACK_URLS=https://your-spotiverse-portal.example/auth/heimdall/callback
 ```
 
-Spotiverse needs only the Heimdall base URL, matching app secret, and local
-portal callback/return URLs. The callback URL Spotiverse sends in
+Spotiverse needs only the Heimdall base URL and local portal callback/return
+URLs. The callback URL Spotiverse sends in
 `HEIMDALL_CALLBACK_URL` must exactly match one URL in Heimdall's
 `GC_ACCESS_APP_SPOTIVERSE_BACKEND_CALLBACK_URLS` allowlist unless both services
 are running on the same local host.
diff --git a/docs/service-contract.md b/docs/service-contract.md
index 68eb6a5..c639178 100644
--- a/docs/service-contract.md
+++ b/docs/service-contract.md
@@ -451,8 +451,9 @@ Purpose:
 Authentication:
 
 - requires `x-heimdall-app-secret`
-- the configured secret comes from `GC_ACCESS_APP_{APP_SLUG}_SHARED_SECRET`,
-  per app; there is no generic fallback secret shared across apps
+- the configured secret comes from the credential file named by
+  `GC_ACCESS_APP_{APP_SLUG}_SHARED_SECRET_FILE`, per app; there is no generic
+  fallback secret shared across apps
 
 Request body:
 
diff --git a/notes/fresh-workspace-handoff.md b/notes/fresh-workspace-handoff.md
index 9a4fdab..a8502a3 100644
--- a/notes/fresh-workspace-handoff.md
+++ b/notes/fresh-workspace-handoff.md
@@ -233,9 +233,10 @@ Bifrost needs browser verification after deployment:
 
 - configure Heimdall with
   `GC_ACCESS_APP_BIFROST_BACKEND_CALLBACK_URLS=https://bifrost.gamecult.org/auth/heimdall/callback`
-- configure Heimdall with `GC_ACCESS_APP_BIFROST_SHARED_SECRET`,
+- configure Heimdall with `GC_ACCESS_APP_BIFROST_SHARED_SECRET_FILE`,
   `GC_ACCESS_BIFROST_PATRON_SUPPORT_ENDPOINT=https://bifrost.gamecult.org/heimdall/patron-support/events`,
-  and `GC_ACCESS_BIFROST_PATRON_SUPPORT_SECRET`
+  and `GC_ACCESS_BIFROST_PATRON_SUPPORT_SECRET_FILE`, each naming a credential
+  file
 - configure Bifrost with `Heimdall__DiscordGuildId`,
   `Heimdall__DiscordAllowedRoleIds__0=<KTLST-role-id>`, and
   `Heimdall__PatreonTierTitle=Inner Sanctum`