diff --git a/secrets/media.secrets.example b/secrets/media.secrets.example
new file mode 100644
index 0000000..f417cb5
--- /dev/null
+++ b/secrets/media.secrets.example
@@ -0,0 +1,26 @@
+# media Stack — Secrets Reference
+# Source: media.env
+#
+# ✅ NO SECRETS — This stack contains no sensitive values.
+# All values are configuration settings safe to store in the compose file directly.
+#
+# This makes media an ideal first stack to test the pipeline with,
+# as there is nothing to provision in the provision-secrets step.
+
+# ── NON-SECRETS (all values safe in compose file or .env) ─────────────────────
+
+# PLEX_PUID          Process UID (0)
+# PLEX_PGID          Process GID (0)
+# ADVERTISE_IP       Plex advertised URL
+# LAN_NETWORK        Trusted LAN CIDR ranges for TicketBox
+# PLEX_HOST          Traefik hostname
+# RADARR_HOST        Traefik hostname
+# SONARR_HOST        Traefik hostname
+# TICKETBOX_HOST     Traefik hostname
+# JACKETT_HOST       Traefik hostname
+
+# ── Woodpecker provision-secrets case entry ───────────────────────────────────
+#
+#   media)
+#     echo "  No secrets required for media stack"
+#     ;;