diff --git a/stacks/resume/docker-compose.yml b/stacks/resume/docker-compose.yml
index 00a02d6..40aeb79 100644
--- a/stacks/resume/docker-compose.yml
+++ b/stacks/resume/docker-compose.yml
@@ -3,6 +3,7 @@
 # Volume -> bind-mount conversions (tiered per density policy):
 #   postgres data  -> /config/resume/postgres        (SSD; DB, low density)
 #   minio  data    -> /storage1/labdata/resume/minio (ZFS; object store, blobs)
+#   redis  data    -> /config/resume/redis           (SSD; AI agent stream state)
 #   app uploads    -> /storage1/labdata/resume/data  (ZFS; blobs, see app below)
 # The Chrome service is stateless. app + resume-minio join edge (resume.ginnoir.com,
 # storage.j-costa.com, minio.ginnoir.com); postgres stays private.
@@ -69,6 +70,22 @@ services:
       - EXIT_ON_HEALTH_FAILURE=true
       - PRE_REQUEST_HEALTH_CHECK=true
 
+  redis:
+    container_name: redis_resume
+    image: redis:7-alpine
+    restart: unless-stopped
+    labels:
+      - "com.centurylabs.watchtower.enable=false"
+    networks: [resume]
+    command: --save 60 1 --loglevel warning
+    volumes:
+      - /config/resume/redis:/data
+    healthcheck:
+      test: ["CMD", "redis-cli", "ping"]
+      interval: 10s
+      timeout: 5s
+      retries: 5
+
   app:
     container_name: resume
     image: amruthpillai/reactive-resume:latest
@@ -88,6 +105,8 @@ services:
         condition: service_healthy
       resume-minio:
         condition: service_healthy
+      redis:
+        condition: service_healthy
       chrome:
         condition: service_started
     env_file:
diff --git a/stacks/resume/stack.env b/stacks/resume/stack.env
index fa9e9d2..ef178ae 100644
--- a/stacks/resume/stack.env
+++ b/stacks/resume/stack.env
@@ -28,3 +28,11 @@ STORAGE_SECRET_KEY=minioadmin
 AUTH_SECRET=1b7e96f61f080d04d4bf673d9ea1d9349eb7693cddee5772b6c3f153c88032db5b97efd8570087bc6f340d2cd874aabc1e5c681bc22889921240d6a23738bc7f
 OAUTH_CLIENT_ID=YpMFNp9q5mGbN8ADM5rUol0ERHmSiTDClJKIVOxK
 OAUTH_CLIENT_SECRET=mzwjSt0Xtibo156km61T7VYerT48K6ZTa79cEek4mgdky6t1Sjaddlshw2QcJL8727N6qWzddi2ihxNGSpUVMXUBbjNgx4jtkHAy5xtmvqdk9ouIFclyhCgXh9fzjMCA
+
+# AI features (v5). ENCRYPTION_SECRET encrypts stored AI provider API keys at
+# rest (schema requires >=32 chars); without it the AI Integrations tab throws
+# AI_CREDENTIAL_ENCRYPTION_UNAVAILABLE. Rotating it makes every saved provider
+# key undecryptable, so pin it like AUTH_SECRET. Generate: openssl rand -hex 32
+# REDIS_URL is additionally required by the AI agent workspace (streaming).
+ENCRYPTION_SECRET=2310384c2befea91af4bb6cdc5dc0eea2b1e492c0ac61003b64356abecad7a61
+REDIS_URL=redis://redis_resume:6379