diff --git a/secrets/maintenance.secrets.example b/secrets/maintenance.secrets.example
new file mode 100644
index 0000000..caf59b5
--- /dev/null
+++ b/secrets/maintenance.secrets.example
@@ -0,0 +1,21 @@
+# maintenance Stack — Secrets Reference
+# Source: maintenance.env
+#
+# ✅ NO SECRETS — This stack contains no sensitive values.
+# All values are hostnames/URLs safe to store in the compose file directly.
+#
+# This makes maintenance an ideal first stack to test the pipeline with,
+# as there is nothing to provision in the provision-secrets step.
+
+# ── NON-SECRETS (all values safe in compose file or .env) ─────────────────────
+
+# CRONICLE_base_app_url              Cronicle public URL
+# CRONICLE_custom_live_log_socket_url Cronicle WebSocket URL
+# CRONICLE_HOST                      Traefik hostname
+# UPTIME_HOST                        Traefik hostname
+
+# ── Woodpecker provision-secrets case entry ───────────────────────────────────
+#
+#   maintenance)
+#     echo "  No secrets required for maintenance stack"
+#     ;;