diff --git a/.wordlist.txt b/.wordlist.txt
index 0aaeb5ce5d..061c16db3d 100644
--- a/.wordlist.txt
+++ b/.wordlist.txt
@@ -297,6 +297,7 @@ CycloneDX
 DAL
 DBAL
 DDL
+DER
 DESC
 DHL
 DIC
@@ -1703,6 +1704,8 @@ jwt
 kebabCase
 keyframes
 keypress
+keystore
+keystores
 landingpage
 lang
 lavinmq
diff --git a/products/paas/shopware/fundamentals/secrets.md b/products/paas/shopware/fundamentals/secrets.md
index 2a5f2f8374..361bafbc32 100644
--- a/products/paas/shopware/fundamentals/secrets.md
+++ b/products/paas/shopware/fundamentals/secrets.md
@@ -14,7 +14,7 @@ Secrets stored in Vault are reusable, which means that you can reuse a secret va
 
 A secret is composed of a type, a key, and a value. Once created, it is assigned a unique `secret-id`, which is required for retrieving or deleting the secret.
 
-The supported types are `env`, `buildenv`, and `ssh`. `env` is available at runtime in the application, `buildenv` is accessible during build processes, and `ssh` keys are for secure connections.
+The supported types are `env`, `buildenv`, `ssh`, and `file`. `env` is available at runtime in the application, `buildenv` is accessible during build processes, `ssh` keys are for secure connections, and `file` secrets are mounted as a file at an absolute path inside the application container.
 
 To create a secret, use the following command:
 
@@ -22,6 +22,17 @@ To create a secret, use the following command:
 sw-paas vault create
 ```
 
+### File secrets
+
+A `file` secret is written to a file inside the container instead of being exposed as an environment variable. Use `--path` to set the absolute mount path and `--file` to read the value from a local file:
+
+```sh
+sw-paas vault create --type file --key CLIENT_CERT \
+  --path /var/www/certs/client.pem --file ./client.pem
+```
+
+The value is stored verbatim, so binary content such as keystores or DER certificates stays intact. If you omit `--path`, the CLI prompts for it. The file is mounted read-only and is not executable.
+
 ## Listing all Vault secrets
 
 ```sh
diff --git a/products/paas/shopware/guides/secrets-vault-guide.md b/products/paas/shopware/guides/secrets-vault-guide.md
index 3a1eaa2f18..feb79ad577 100644
--- a/products/paas/shopware/guides/secrets-vault-guide.md
+++ b/products/paas/shopware/guides/secrets-vault-guide.md
@@ -15,16 +15,18 @@ The Vault is a secure, centralized location to store sensitive data such as:
 - Environment variables
 - Build-time secrets
 - SSH keys for accessing private Git repositories
+- Files such as certificates or keystores
 
 Secrets stored in the Vault are reusable across all applications in your organization.
 
 ## Secret Types
 
-| Type       | Description                                |
-| ---------- | ------------------------------------------ |
-| `env`      | Runtime environment variables for your app |
-| `buildenv` | Build-time environment variables           |
-| `ssh`      | SSH keys for secure Git access             |
+| Type       | Description                                        |
+| ---------- | -------------------------------------------------- |
+| `env`      | Runtime environment variables for your app         |
+| `buildenv` | Build-time environment variables                   |
+| `ssh`      | SSH keys for secure Git access                     |
+| `file`     | Files mounted at an absolute path in the container |
 
 ## Creating a Secret
 
@@ -46,6 +48,44 @@ sw-paas vault create --type ssh
 
 After generation, the CLI will output the public key. Add this to your Git hosting provider (e.g., GitHub under **Deploy Keys**).
 
+### Creating a File Secret
+
+A `file` secret is mounted as a file inside the application container, for example a client certificate or a Java keystore:
+
+```sh
+sw-paas vault create --type file --key CLIENT_CERT \
+  --path /var/www/certs/client.pem --file ./client.pem
+```
+
+| Flag     | Description                                                                     |
+| -------- | ------------------------------------------------------------------------------- |
+| `--path` | Absolute path the file is mounted at inside the container. Prompted if omitted. |
+| `--file` | Local file to read the value from. The content is stored verbatim.              |
+
+`--file` keeps binary content intact. Alternatively, pipe the content with `--password-stdin`; for `file` secrets, stdin is also read unmodified.
+
+::: info
+File secrets are mounted read-only and without execute permission. Your application can read the file, but cannot modify or execute it.
+:::
+
+## Updating a Secret
+
+To change the value of an existing secret:
+
+```sh
+sw-paas vault update --secret-id SECRET-ID
+```
+
+Use `--file` or `--password-stdin` to provide the new value non-interactively.
+
+For `file` secrets, `--path` moves the secret to a different mount path. Without `--file` or `--password-stdin`, only the path changes and the content is kept:
+
+```sh
+sw-paas vault update --secret-id SECRET-ID --path /var/www/certs/new-client.pem
+```
+
+If you omit `--path`, the stored path stays untouched. In an interactive terminal, the CLI asks whether you want to change it.
+
 ## Retrieving a Secret
 
 Secrets are accessed by their unique `secret-id`. You can retrieve a secret using: