diff --git a/secrets/vaultwarden.secrets.example b/secrets/vaultwarden.secrets.example
new file mode 100644
index 0000000..e2fdd83
--- /dev/null
+++ b/secrets/vaultwarden.secrets.example
@@ -0,0 +1,37 @@
+# vaultwarden Stack — Secrets Reference
+# Source: vaultwarden.env
+#
+# Add SECRET values to Woodpecker at:
+#   https://woodpecker.bryanmail.net
+#   homelab/compose-files → Settings → Secrets
+#
+# ⚠️  HIGH VALUE TARGET: Vaultwarden stores all passwords for the household.
+#     Treat the admin token and database URL with extreme care.
+#     Ensure you have an offline backup of the Vaultwarden data volume
+#     before making any changes to this stack.
+
+# ── SECRETS (add to Woodpecker) ───────────────────────────────────────────────
+
+# Woodpecker secret name:  vaultwarden_admin_token
+# Used for:               Vaultwarden admin panel access token (Argon2id hash)
+#                         Generate with: vaultwarden hash --preset owasp
+#                         Store the full $argon2id$... hash string
+# Env var in .env:        ADMIN_TOKEN
+vaultwarden_admin_token=
+
+# Woodpecker secret name:  vaultwarden_database_url
+# Used for:               Vaultwarden PostgreSQL connection string (contains password)
+#                         Store the full postgresql://... URL
+# Env var in .env:        DATABASE_URL
+vaultwarden_database_url=
+
+# ── NON-SECRETS (safe in compose file or .env) ────────────────────────────────
+
+# VAULTWARDEN_RULE    Traefik routing rule (multi-hostname expression)
+
+# ── Woodpecker provision-secrets case entry ───────────────────────────────────
+#
+#   vaultwarden)
+#     create_or_update_secret "vaultwarden_admin_token"   "$VAULTWARDEN_ADMIN_TOKEN"
+#     create_or_update_secret "vaultwarden_database_url"  "$VAULTWARDEN_DATABASE_URL"
+#     ;;