diff --git a/.gitignore b/.gitignore
index 8d2999e..71cd873 100644
--- a/.gitignore
+++ b/.gitignore
@@ -5,3 +5,5 @@ bin/
 runtime-bin/
 data/*
 !data/.gitkeep
+secrets/*
+!secrets/.gitkeep
diff --git a/docker-compose.yml b/docker-compose.yml
index 77ab071..b849d01 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -14,4 +14,6 @@ services:
       - "${PORT:-8317}:${PORT:-8317}"
     volumes:
       - ./data:/app/data
+      # Read-only secrets (session bundles, etc). Created outside git; see README.
+      - ./secrets:/secrets:ro
     restart: unless-stopped
diff --git a/secrets/.gitkeep b/secrets/.gitkeep
new file mode 100644
index 0000000..e69de29