diff --git a/README.md b/README.md
index e515706..63ffb05 100644
--- a/README.md
+++ b/README.md
@@ -533,9 +533,13 @@ All custom code lives in `src/app/` on the `lotus` branch of `code.lotusguild.or
   "defaultHomeserver": 0,
   "homeserverList": ["matrix.lotusguild.org"],
   "allowCustomHomeservers": false,
-  "gifApiKey": "AqqDuQwZNjYttz7Mn6ME4JH1bJIuZ5CO"
+  "gifApiKey": ""
 }
 ```
+> **Note:** `gifApiKey` is a runtime secret — it is **not** stored in git. The placeholder
+> ships empty; `lotus_deploy.sh` injects the real key from `GIPHY_API_KEY` in
+> `/etc/lotus-deploy.env` on LXC 106 after each deploy. (For that injection to work the
+> deployed `config.json` must contain the `"gifApiKey": ""` placeholder line.)
 
 > Note: The root `/opt/lotus-cinny/config.json` is what matters — vite copies it to `dist/`. `public/config.json` is not used.
 
diff --git a/cinny/config.json b/cinny/config.json
index 5842ecb..75f8fe4 100644
--- a/cinny/config.json
+++ b/cinny/config.json
@@ -15,5 +15,6 @@
   "hashRouter": {
     "enabled": false,
     "basename": "/"
-  }
+  },
+  "gifApiKey": ""
 }
\ No newline at end of file