diff --git a/CLAUDE.md b/CLAUDE.md
index 9b528fd..5238b8c 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -8,7 +8,7 @@ Deployment configuration for a **live, single-host Docker homelab** running on a
 
 **The repo is canonical.** Portainer polls this repo's `main` branch every 5 min and redeploys any application stack whose source files have changed. Editing here changes nothing until you push to GitHub (or, for the management plane, run `apply-compose.ps1 -Portainer`).
 
-`.env` and `stacks/*/.env` are committed **intentionally** — the GitHub repo `ginnoir/homelabstack` is private and the stack's secrets are versioned with it. Do not scrub or gitignore them.
+`.env` and `stacks/*/stack.env` are committed **intentionally** — the GitHub repo `ginnoir/homelabstack` is private and the stack's secrets are versioned with it. Do not scrub or gitignore them.
 
 ## Layout
 
@@ -91,7 +91,7 @@ ssh ginnoir@valhalla "docker compose -f /data/compose/14/stacks/owncloud/docker-
 
 1. Pick the stack it belongs to under `stacks/<domain>/` (or create a new stack and a new Portainer git stack for it).
 2. Add the service to `stacks/<domain>/docker-compose.yml`. Configs → `/config/<svc>` bind. Blobs → `/storage1/labdata/<svc>` bind. Add `edge` to its `networks:` if Caddy must reach it; otherwise just the per-stack private net.
-3. Add secrets to `stacks/<domain>/.env`.
+3. Add secrets to `stacks/<domain>/stack.env` (Portainer reads this file directly from the git repo on each redeploy).
 4. Add a site block to `Caddyfile` (`reverse_proxy <container_name>:<port>`); `import internal_only` for LAN-only.
 5. Run `./scripts/gen-bookmarks.ps1` to regenerate `bookmarks-domains.html` + `bookmarks-ports.html` from the new Caddy block / published ports.
 6. `git push`. Portainer redeploys the stack within 5 min; the runner reloads Caddy on the same push if `Caddyfile` changed.
@@ -107,7 +107,7 @@ ssh ginnoir@valhalla "docker compose -f /data/compose/14/stacks/owncloud/docker-
 - A **GateGuard hook** blocks the first use of `Bash`, and every `Write`/`Edit`, until you state the required facts (the user request + what the operation does/affects). State them, then retry the same call.
 - `Caddyfile` proxies `matrix.ginnoir.com → localhost:8008`, but there is **no Matrix/Synapse service in compose** — it's external/legacy. Likewise `dev.ginnoir.com → 192.168.1.74:3000` points at a different LAN host.
 - `watchtower` auto-updates `:latest` images, so a running image can drift ahead of what the last `apply` pulled.
-- Line endings: `.gitattributes` forces **LF** so files stay Unix-clean. Pushing CRLF (especially `.env`) to the Linux host appends stray `\r` to values and breaks things.
+- Line endings: `.gitattributes` forces **LF** so files stay Unix-clean. Pushing CRLF (especially `stack.env`) to the Linux host appends stray `\r` to values and breaks things.
 - The runner workflow (`.github/workflows/deploy.yml`) may be **disabled** at the GitHub repo level — check `gh workflow list` if Caddyfile pushes don't trigger a reload. Manual fallback: `apply-compose.ps1 -Caddy`.
 
 ## Skills
diff --git a/stacks/authentik/.env b/stacks/authentik/stack.env
similarity index 100%
rename from stacks/authentik/.env
rename to stacks/authentik/stack.env
diff --git a/stacks/dev/.env b/stacks/dev/stack.env
similarity index 100%
rename from stacks/dev/.env
rename to stacks/dev/stack.env
diff --git a/stacks/famapp/.env b/stacks/famapp/stack.env
similarity index 100%
rename from stacks/famapp/.env
rename to stacks/famapp/stack.env
diff --git a/stacks/foundry/.env b/stacks/foundry/stack.env
similarity index 100%
rename from stacks/foundry/.env
rename to stacks/foundry/stack.env
diff --git a/stacks/media/.env b/stacks/media/stack.env
similarity index 100%
rename from stacks/media/.env
rename to stacks/media/stack.env
diff --git a/stacks/monitoring/.env b/stacks/monitoring/stack.env
similarity index 100%
rename from stacks/monitoring/.env
rename to stacks/monitoring/stack.env
diff --git a/stacks/notify/.env b/stacks/notify/stack.env
similarity index 100%
rename from stacks/notify/.env
rename to stacks/notify/stack.env
diff --git a/stacks/owncloud/.env b/stacks/owncloud/stack.env
similarity index 100%
rename from stacks/owncloud/.env
rename to stacks/owncloud/stack.env
diff --git a/stacks/proxy/.env b/stacks/proxy/stack.env
similarity index 100%
rename from stacks/proxy/.env
rename to stacks/proxy/stack.env
diff --git a/stacks/resume/.env b/stacks/resume/stack.env
similarity index 100%
rename from stacks/resume/.env
rename to stacks/resume/stack.env