diff --git a/researchowl/deployment.yaml b/researchowl/deployment.yaml
index c04140e..8d9c51f 100644
--- a/researchowl/deployment.yaml
+++ b/researchowl/deployment.yaml
@@ -62,6 +62,11 @@ spec:
               value: "3"
             - name: QUALITY_THRESHOLD
               value: "0.4"
+            - name: ANTHROPIC_API_KEY
+              valueFrom:
+                secretKeyRef:
+                  name: researchowl-secrets
+                  key: anthropic-api-key
           volumeMounts:
             - name: data
               mountPath: /data
@@ -78,3 +83,10 @@ spec:
             claimName: researchowl-data
       imagePullSecrets:
         - name: gitea-registry
+
+# Secret is managed imperatively (not by ArgoCD) to avoid overwriting real values:
+# kubectl create secret generic researchowl-secrets \
+#   --from-literal=telegram-bot-token=YOUR_TOKEN \
+#   --from-literal=telegram-allowed-users=YOUR_USER_ID \
+#   --from-literal=anthropic-api-key=YOUR_KEY \
+#   -n researchowl