diff --git a/k8s/secrets.example.yaml b/k8s/secrets.example.yaml
index 4f92d330..60cbe8bd 100644
--- a/k8s/secrets.example.yaml
+++ b/k8s/secrets.example.yaml
@@ -40,10 +40,15 @@ metadata:
   namespace: towerops
 type: Opaque
 stringData:
-  # Full ecto:// URL — used envFrom in the deployment.
+  # Full ecto:// URL — what runtime.exs reads.
   DATABASE_URL: "ecto://USER:PASSWORD@HOST:5432/DATABASE"
-  # Optional pool tuning (defaults applied in runtime.exs if unset)
-  POOL_SIZE: ""
+  # The individual fields are convenience for ops — not required by the
+  # app but kept here for parity with the existing prod secret.
+  POSTGRES_HOST: ""
+  POSTGRES_PORT: "5432"
+  POSTGRES_DB: ""
+  POSTGRES_USER: ""
+  POSTGRES_PASSWORD: ""
 ---
 apiVersion: v1
 kind: Secret
@@ -63,8 +68,11 @@ metadata:
   namespace: towerops
 type: Opaque
 stringData:
-  # envFrom block injects whatever keys exist here.
-  REDIS_URL: "redis://HOST:6379/0"
+  # K8s pattern — runtime.exs builds the connection from these
+  # individual fields. Dokku alternative is REDIS_URL.
+  REDIS_HOST: ""
+  REDIS_PORT: "6379"
+  REDIS_PASSWORD: ""
 ---
 apiVersion: v1
 kind: Secret