diff --git a/docs/deployment.md b/docs/deployment.md
index 30e8949..2cb223c 100644
--- a/docs/deployment.md
+++ b/docs/deployment.md
@@ -12,6 +12,10 @@ to the app/auth and browser storage endpoint respectively. Route web to port
 services are public; do not expose Postgres or Garage's admin/RPC ports.
 Set `EMAIL_FROM`, `RESEND_API_KEY`, and `RESEND_WEBHOOK_SECRET` in Coolify before
 starting. Generated credentials belong to this stack, not other applications.
+Coolify does not generate 24-character hex values automatically: initialize
+`SERVICE_HEX_24_S3KEY` with 12 cryptographically random bytes encoded as hex
+before the first deployment. The Compose file adds Garage's `GK` prefix.
+Keep that identifier and all storage secrets stable across redeployments.
 Keep worker concurrency at one initially on a shared VM. Back up all three
 data volumes off-host and verify recovery before collecting real wedding photos.