diff --git a/ai/ai.env.template b/ai/ai.env.template
index cc55720..d3c34d9 100644
--- a/ai/ai.env.template
+++ b/ai/ai.env.template
@@ -5,50 +5,51 @@
 #   - This file IS the complete key list for ai.env. The whole file is
 #     rendered on every provisioning run — no line surgery, so a key can
 #     never silently go missing again (root cause of the 2026-09-03 outage).
+#   - Key names match EXACTLY what ai/ai.yaml references (AI_<SERVICE>_*
+#     naming adopted on main 2026-09-06).
 #   - Non-secret config lives here as LITERAL values (visible, reviewable).
-#   - Secret values are dollar-brace placeholders resolved from Woodpecker
-#     secrets at provisioning time. provision-stack.py FAILS HARD if any
-#     placeholder is missing/empty — a broken render can never ship.
+#   - Secret values are dollar-brace placeholders resolved from the CI env
+#     (Woodpecker from_secret vars) at provisioning time. provision-stack.py
+#     FAILS HARD if any placeholder is missing/empty.
 #   - The rendered ai/ai.env exists only on the host (gitignored).
-#   - NOTE: this template is rendered by provision-stack.py, NOT by
-#     Woodpecker's yaml preprocessor — single-dollar placeholders here are
-#     safe and correct (the deploy.yml double-dollar rule does NOT apply to
-#     this file).
+#   - Rendered by provision-stack.py, NOT Woodpecker's yaml preprocessor —
+#     single-dollar placeholders are safe here (deploy.yml's double-dollar
+#     rule does NOT apply to this file).
 #
 # Consumed by ai/ai.yaml. DOMAIN_NAME comes from deploy/global.env, not here.
 # ─────────────────────────────────────────────────────────────────────────────
 
 # ── LiteLLM (non-secret config) ──────────────────────────────────────────────
-AWS_REGION_NAME=us-east-2
-LITELLM_MODIFY_PARAMS=False
-LITELLM_DATABASE_MIGRATIONS=True
+AI_AWS_REGION_NAME=us-east-2
+AI_LITELLM_MODIFY_PARAMS=False
+AI_LITELLM_DATABASE_MIGRATIONS=True
 
 # ── LiteLLM (secrets) ────────────────────────────────────────────────────────
 AI_AWS_ACCESS_KEY_ID=${AI_AWS_ACCESS_KEY_ID}
 AI_AWS_SECRET_ACCESS_KEY=${AI_AWS_SECRET_ACCESS_KEY}
-LITELLM_MASTER_KEY=${AI_LITELLM_MASTER_KEY}
-LITELLM_SALT_KEY=${AI_LITELLM_SALT_KEY}
+AI_LITELLM_MASTER_KEY=${AI_LITELLM_MASTER_KEY}
+AI_LITELLM_SALT_KEY=${AI_LITELLM_SALT_KEY}
 # Full connection URL is itself a secret (ai_litellm_database_url) — the
 # URL structure never appears in git.
-DATABASE_URL=${AI_LITELLM_DATABASE_URL}
-POSTGRES_PASSWORD=${AI_LITELLM_POSTGRES_PASSWORD}
+AI_LITELLM_DATABASE_URL=${AI_LITELLM_DATABASE_URL}
+AI_LITELLM_POSTGRES_PASSWORD=${AI_LITELLM_POSTGRES_PASSWORD}
 
 # ── Open WebUI (non-secret config) ───────────────────────────────────────────
-WEBUI_URL=https://ai.bryanmail.net
-ENABLE_OAUTH_SIGNUP=true
-OAUTH_MERGE_ACCOUNTS_BY_EMAIL=true
-OAUTH_PROVIDER_NAME=Authentik
-OPENID_PROVIDER_URL=https://auth.bryanmail.net/application/o/open-web-ui/.well-known/openid-configuration
+AI_OPEN_WEBUI_URL=https://ai.bryanmail.net
+AI_OPEN_WEBUI_ENABLE_OAUTH_SIGNUP=true
+AI_OPEN_WEBUI_OAUTH_MERGE_ACCOUNTS_BY_EMAIL=true
+AI_OPEN_WEBUI_OAUTH_PROVIDER_NAME=Authentik
+AI_OPEN_WEBUI_OPENID_PROVIDER_URL=https://auth.bryanmail.net/application/o/open-web-ui/.well-known/openid-configuration
 # OAuth client ID is a public identifier by OAuth2 design (it is sent to the
 # browser); the client SECRET below is the protected credential.
-OAUTH_CLIENT_ID=hVmhi1dS3TnG2cUw5QwLOx5FDLSWtnQUdZyeB5zK
-OAUTH_SCOPES=openid email profile
-OPENID_REDIRECT_URI=https://ai.bryanmail.net/oauth/oidc/callback
+AI_OPEN_WEBUI_OAUTH_CLIENT_ID=hVmhi1dS3TnG2cUw5QwLOx5FDLSWtnQUdZyeB5zK
+AI_OPEN_WEBUI_OAUTH_SCOPES=openid email profile
+AI_OPEN_WEBUI_OPENID_REDIRECT_URI=https://ai.bryanmail.net/oauth/oidc/callback
 
 # ── Open WebUI (secrets) ─────────────────────────────────────────────────────
-WEBUI_SECRET_KEY=${AI_WEBUI_SECRET_KEY}
-OPEN_WEBUI_DATABASE_URL=${AI_OPEN_WEBUI_DATABASE_URL}
-OAUTH_CLIENT_SECRET=${AI_OPEN_WEB_UI_OAUTH_CLIENT_SECRET}
+AI_OPEN_WEBUI_SECRET_KEY=${AI_OPEN_WEBUI_SECRET_KEY}
+AI_OPEN_WEBUI_DATABASE_URL=${AI_OPEN_WEBUI_DATABASE_URL}
+AI_OPEN_WEBUI_OAUTH_CLIENT_SECRET=${AI_OPEN_WEBUI_OAUTH_CLIENT_SECRET}
 
 # ── mcpo / mcpo-critical (secrets) ───────────────────────────────────────────
 MCPO_API_KEY=${AI_MCPO_API_KEY}