diff --git a/self-host/advanced/config-file.mdx b/self-host/advanced/config-file.mdx
index fe0011e..d81650d 100644
--- a/self-host/advanced/config-file.mdx
+++ b/self-host/advanced/config-file.mdx
@@ -310,7 +310,7 @@ This section contains the complete reference for all configuration options in `c
 
       **Default**: `false`
 
-      **Environment Variable**: `ENABLE_AI_GATEWAY_CLIENT_IP_HEADER`
+      **Environment Variable**: `ENABLE_AI_GATEWAY_CLIENT_IP_HEADER` (or `ENABLE_AI_GATEWAY_CLIENT_IP_HEADER_FILE` to read the value from a file — see [Reading secrets from a file](#reading-secrets-from-a-file-_file-suffix))
 
       <Note>
         Useful when an intermediary proxy sits between Traefik and the AI Gateway and overwrites `X-Forwarded-For`/`X-Real-Ip` instead of appending to them. Requires a Badger version that supports `realIpHeader`.
@@ -336,7 +336,7 @@ This section contains the complete reference for all configuration options in `c
     <ResponseField name="secret" type="string" required>
       Secret key for encrypting sensitive data.
 
-      **Environment Variable**: `SERVER_SECRET`
+      **Environment Variable**: `SERVER_SECRET` (or `SERVER_SECRET_FILE` to read the value from a file — see [Reading secrets from a file](#reading-secrets-from-a-file-_file-suffix))
 
       **Minimum Length**: 8 characters
 
@@ -765,7 +765,7 @@ This section contains the complete reference for all configuration options in `c
     <ResponseField name="smtp_user" type="string">
       SMTP username.
 
-      **Environment Variable**: `EMAIL_SMTP_USER`
+      **Environment Variable**: `EMAIL_SMTP_USER` (or `EMAIL_SMTP_USER_FILE` to read the value from a file — see [Reading secrets from a file](#reading-secrets-from-a-file-_file-suffix))
 
       **Example**: `no-reply@example.com`
     </ResponseField>
@@ -773,7 +773,7 @@ This section contains the complete reference for all configuration options in `c
     <ResponseField name="smtp_pass" type="string">
       SMTP password.
 
-      **Environment Variable**: `EMAIL_SMTP_PASS`
+      **Environment Variable**: `EMAIL_SMTP_PASS` (or `EMAIL_SMTP_PASS_FILE` to read the value from a file — see [Reading secrets from a file](#reading-secrets-from-a-file-_file-suffix))
     </ResponseField>
 
     <ResponseField name="smtp_secure" type="boolean">
@@ -938,6 +938,8 @@ This section contains the complete reference for all configuration options in `c
     <ResponseField name="connection_string" type="string" required>
       PostgreSQL connection string.
 
+      **Environment Variable**: `POSTGRES_CONNECTION_STRING` (or `POSTGRES_CONNECTION_STRING_FILE` to read the value from a file — see [Reading secrets from a file](#reading-secrets-from-a-file-_file-suffix))
+
       **Example**: `postgresql://user:password@host:port/database`
 
       <Note>
@@ -948,6 +950,8 @@ This section contains the complete reference for all configuration options in `c
     <ResponseField name="replicas" type="array of objects">
       Read-only replica database configurations for load balancing.
 
+      **Environment Variable**: `POSTGRES_REPLICA_CONNECTION_STRINGS`, a comma-separated list of connection strings (or `POSTGRES_REPLICA_CONNECTION_STRINGS_FILE` to read the same comma-separated list from a file — see [Reading secrets from a file](#reading-secrets-from-a-file-_file-suffix))
+
       <Expandable title="Replica Configuration">
         <ResponseField name="connection_string" type="string" required>
           Connection string for the read replica database.
@@ -1016,7 +1020,7 @@ This section contains the complete reference for all configuration options in `c
     <ResponseField name="connection_string" type="string">
       Connection string for the dedicated logs database.
 
-      **Environment Variable**: `POSTGRES_LOGS_CONNECTION_STRING`
+      **Environment Variable**: `POSTGRES_LOGS_CONNECTION_STRING` (or `POSTGRES_LOGS_CONNECTION_STRING_FILE` to read the value from a file — see [Reading secrets from a file](#reading-secrets-from-a-file-_file-suffix))
 
       **Example**: `postgresql://user:password@host:port/logs_database`
 
@@ -1028,6 +1032,8 @@ This section contains the complete reference for all configuration options in `c
     <ResponseField name="replicas" type="array of objects">
       Read-only replica configurations for the logs database.
 
+      **Environment Variable**: `POSTGRES_LOGS_REPLICA_CONNECTION_STRINGS`, a comma-separated list of connection strings (or `POSTGRES_LOGS_REPLICA_CONNECTION_STRINGS_FILE` to read the same comma-separated list from a file — see [Reading secrets from a file](#reading-secrets-from-a-file-_file-suffix))
+
       <Expandable title="Replica Configuration">
         <ResponseField name="connection_string" type="string" required>
           Connection string for the read replica logs database.
@@ -1179,14 +1185,33 @@ The catalog feeds Known Models pickers, wildcard discovery, provider selection,
 
 Some configuration values can be set using environment variables for enhanced security:
 
-| Name | Variable | Config |
-|------|----------|--------|
-| Server Secret | `SERVER_SECRET` | `server.secret` |
-| Email Username | `EMAIL_SMTP_USER` | `email.smtp_user` |
-| Email Password | `EMAIL_SMTP_PASS` | `email.smtp_pass` |
-| PostgreSQL Connection String | `POSTGRES_CONNECTION_STRING` | `postgres.connection_string` |
-| PostgreSQL Replica Connection Strings | `POSTGRES_REPLICA_CONNECTION_STRINGS` | `postgres.replicas` (comma-separated list of connection strings) |
-| PostgreSQL Logs Connection String | `POSTGRES_LOGS_CONNECTION_STRING` | `postgres_logs.connection_string` |
-| PostgreSQL Logs Replica Connection Strings | `POSTGRES_LOGS_REPLICA_CONNECTION_STRINGS` | `postgres_logs.replicas` (comma-separated list of connection strings) |
-| Enable SQLite WAL Mode | `ENABLE_SQLITE_WAL_MODE` | *(SQLite only)* Set to `true` to enable [WAL mode](https://www.sqlite.org/wal.html) for improved SQLite concurrency |
-| Enable AI Gateway Client IP Header | `ENABLE_AI_GATEWAY_CLIENT_IP_HEADER` | `server.enable_ai_gateway_client_ip_header` |
\ No newline at end of file
+| Name | Variable | Config | Supports `_FILE` |
+|------|----------|--------|:---:|
+| Server Secret | `SERVER_SECRET` | `server.secret` | YES |
+| Email Username | `EMAIL_SMTP_USER` | `email.smtp_user` | YES |
+| Email Password | `EMAIL_SMTP_PASS` | `email.smtp_pass` | YES |
+| PostgreSQL Connection String | `POSTGRES_CONNECTION_STRING` | `postgres.connection_string` | YES |
+| PostgreSQL Replica Connection Strings | `POSTGRES_REPLICA_CONNECTION_STRINGS` | `postgres.replicas` (comma-separated list of connection strings; the file, if used, should contain the same comma-separated list) | YES |
+| PostgreSQL Logs Connection String | `POSTGRES_LOGS_CONNECTION_STRING` | `postgres_logs.connection_string` | YES |
+| PostgreSQL Logs Replica Connection Strings | `POSTGRES_LOGS_REPLICA_CONNECTION_STRINGS` | `postgres_logs.replicas` (comma-separated list of connection strings; the file, if used, should contain the same comma-separated list) | YES |
+| Enable SQLite WAL Mode | `ENABLE_SQLITE_WAL_MODE` | *(SQLite only)* Set to `true` to enable [WAL mode](https://www.sqlite.org/wal.html) for improved SQLite concurrency | YES |
+| Enable AI Gateway Client IP Header | `ENABLE_AI_GATEWAY_CLIENT_IP_HEADER` | `server.enable_ai_gateway_client_ip_header` | YES |
+
+### Reading secrets from a file (`_FILE` suffix)
+
+For any variable marked "Supports `_FILE`" above, you can set `<VARIABLE>_FILE` instead of `<VARIABLE>` to a path on disk, and Pangolin will read that file and use its (trimmed) contents as the value. This is the standard way to consume [Docker/Swarm secrets](https://docs.docker.com/engine/swarm/secrets/) — for example a secret mounted at `/run/secrets/server_secret` — without ever putting the raw value in `config.yml`, a `.env` file, or the container's visible environment.
+
+Setting both `<VARIABLE>` and `<VARIABLE>_FILE` at the same time is an error.
+
+```yaml title="docker-compose.yml"
+services:
+  pangolin:
+    secrets:
+      - server_secret
+    environment:
+      - SERVER_SECRET_FILE=/run/secrets/server_secret
+
+secrets:
+  server_secret:
+    file: ./secrets/server_secret.txt
+```
\ No newline at end of file
diff --git a/self-host/advanced/private-config-file.mdx b/self-host/advanced/private-config-file.mdx
index 5f13ff5..c957594 100644
--- a/self-host/advanced/private-config-file.mdx
+++ b/self-host/advanced/private-config-file.mdx
@@ -106,6 +106,8 @@ This section contains the complete reference for all configuration options in `p
 
     <ResponseField name="password" type="string">
       Redis authentication password.
+
+      **Environment Variable**: `REDIS_PASSWORD` (or `REDIS_PASSWORD_FILE` to read the value from a file — see [Reading secrets from a file](/self-host/advanced/config-file#reading-secrets-from-a-file-_file-suffix))
       
       ```yaml
       redis:
@@ -493,4 +495,14 @@ This section contains the complete reference for all configuration options in `p
 
 ### Branding Configuration
 
-Please refer to the [branding configuration documentation](/manage/branding).
\ No newline at end of file
+Please refer to the [branding configuration documentation](/manage/branding).
+
+## Environment Variables
+
+Some configuration values can be set using environment variables for enhanced security:
+
+| Name | Variable | Config | Supports `_FILE` |
+|------|----------|--------|:---:|
+| Redis Password | `REDIS_PASSWORD` | `redis.password` | ✅ |
+
+Any variable marked "Supports `_FILE`" can also be set as `<VARIABLE>_FILE`, pointing to a file on disk whose (trimmed) contents are used as the value instead — see [Reading secrets from a file](/self-host/advanced/config-file#reading-secrets-from-a-file-_file-suffix) in the main configuration file docs for details and a Docker Compose example.
\ No newline at end of file