diff --git a/docs/mcp-registry-listing.md b/docs/mcp-registry-listing.md
index a6ec1eb..77c2e2b 100644
--- a/docs/mcp-registry-listing.md
+++ b/docs/mcp-registry-listing.md
@@ -17,13 +17,12 @@ Source of truth is [`server.json`](../server.json) at the repo root.
   the version is already live, so re-runs and non-version edits don't fail.
 - **Re-publish (local fallback):**
   ```bash
-  SECRET=/Users/roy/.claude/skills/secrets/scripts/secret
-  $SECRET run KEY=mcp-registry-signing-key -- bash -c \
+  hush run KEY=lifescored-mcp-signing-key -- bash -c \
     'mcp-publisher login http --domain lifescored.com --private-key "$KEY"'
   mcp-publisher publish
   ```
 - **Rotate the signing key:** re-mint locally, regenerate the proof file (`static/.well-known/mcp-registry-auth`)
-  and redeploy, then push the new key to GitHub: `$SECRET pipe mcp-registry-signing-key -- gh secret set MCP_PRIVATE_KEY`.
+  and redeploy, then push the new key to GitHub: `hush pipe lifescored-mcp-signing-key -- gh secret set MCP_PRIVATE_KEY`.
 - Verify any publish: `curl -s "https://registry.modelcontextprotocol.io/v0/servers?search=lifescored"`.
 
 ## Other directories
diff --git a/infra/.hush b/infra/.hush
new file mode 100644
index 0000000..83e7b8d
--- /dev/null
+++ b/infra/.hush
@@ -0,0 +1,6 @@
+# hush manifest for OpenTofu. tofu reads its creds from the environment, so run it through hush:
+#   hush exec -- tofu plan        (from this infra/ dir; injects the values below from the keychain)
+# Only env-var -> hush-secret-name mappings here. No secret values — safe to commit.
+CLOUDFLARE_API_TOKEN=lifescored-iac-token
+AWS_ACCESS_KEY_ID=lifescored-r2-access-key-id
+AWS_SECRET_ACCESS_KEY=lifescored-r2-secret-access-key
diff --git a/infra/README.md b/infra/README.md
index 82e094c..3276c87 100644
--- a/infra/README.md
+++ b/infra/README.md
@@ -34,13 +34,14 @@ The CF API token is account-owned, scoped to the `lifescored.com` zone, with: DN
 Zone Settings:Edit, Dynamic URL Redirects:Edit, Email Routing Rules. It is injected from the
 keychain at run time and never written to disk. The R2 state-bucket creds come the same way.
 
+Creds live in [hush](https://github.com/royashbrook/hush); [`infra/.hush`](.hush) maps the env vars
+tofu needs (`CLOUDFLARE_API_TOKEN`, `AWS_ACCESS_KEY_ID`, `AWS_SECRET_ACCESS_KEY`) to the `lifescored-*`
+secrets, so `hush exec` injects them — never printed, never on disk. Run from this `infra/` dir:
+
 ```sh
-SECRET=/Users/roy/.claude/skills/secrets/scripts/secret
-RUN="$SECRET run CLOUDFLARE_API_TOKEN=lifescored-iac-token \
-  AWS_ACCESS_KEY_ID=lifescored-r2-access-key-id \
-  AWS_SECRET_ACCESS_KEY=lifescored-r2-secret-access-key --"
-$RUN tofu -chdir=infra plan     # review the diff
-$RUN tofu -chdir=infra apply    # apply it
+cd infra
+hush exec -- tofu plan     # review the diff
+hush exec -- tofu apply    # apply it
 ```
 
 ## state
diff --git a/infra/providers.tf b/infra/providers.tf
index 544daa1..99a02d0 100644
--- a/infra/providers.tf
+++ b/infra/providers.tf
@@ -2,9 +2,10 @@
 # settings, redirect rules, email routing) as declarative IaC. wrangler still owns the worker
 # code deploy and the apex custom domain; this owns everything around it.
 #
-# Auth: the CF API token is injected from the keychain at run time, never written here:
-#   secret run CLOUDFLARE_API_TOKEN=lifescored-iac-token -- tofu plan
-# (the cloudflare provider reads CLOUDFLARE_API_TOKEN from the env automatically.)
+# Auth: creds are injected from the keychain at run time (never written here) via hush + `.hush`:
+#   hush exec -- tofu plan        (run from infra/; injects the CF token + the R2 S3 keys)
+# The cloudflare provider reads CLOUDFLARE_API_TOKEN from the env; the s3 backend reads AWS_* — both
+# mapped in infra/.hush to the lifescored-* hush secrets.
 
 terraform {
   required_version = ">= 1.9"