diff --git a/.env.example b/.env.example
index 957c131..18b61cc 100644
--- a/.env.example
+++ b/.env.example
@@ -1,20 +1,20 @@
-# Storage stack — Postgres + MinIO
+# Storage stack — Postgres + Garage (S3)
 # Copy to .env for local use. Production .env is regenerated by the deploy
 # workflow from Forgejo secrets.
 
 # Postgres superuser (used only by init + admin tasks)
 POSTGRES_PASSWORD=change-me
 
-# MinIO root account (used only by init + admin tasks)
-MINIO_ROOT_USER=storage-admin
-MINIO_ROOT_PASSWORD=change-me-32-chars-min
-
-# Per-app credentials provisioned by the init containers.
+# Per-app credentials provisioned by the init steps.
 # These are also added as secrets on every consuming app's repo.
+# S3 pairs: see SECRETS.md for Garage's key format.
 ASXPIO_DB_PASSWORD=change-me
 ASXPIO_S3_ACCESS_KEY=change-me
 ASXPIO_S3_SECRET_KEY=change-me
-# datacenterbingo: read-only on asxpio's bingo tables and bingo/ photos.
+# datacenterbingo: read-only on asxpio's bingo tables and the photo bucket.
 BINGO_DB_PASSWORD=change-me
 BINGO_S3_ACCESS_KEY=change-me
 BINGO_S3_SECRET_KEY=change-me
+# Uploader for the public bucket (put and delete only). Optional.
+PUBLIC_S3_ACCESS_KEY=change-me
+PUBLIC_S3_SECRET_KEY=change-me