diff --git a/README.md b/README.md
index a1dedf3..a2d3eb2 100644
--- a/README.md
+++ b/README.md
@@ -51,7 +51,7 @@ The namespace must exist first, and so must the AppRole Secret the store reads.
 | `TLS_ISSUER_NAME`, `TLS_ISSUER_KIND` | a cert-manager issuer, e.g. `ClusterIssuer` |
 | `VAULT_SERVER`, `VAULT_MOUNT`, `VAULT_SECRET_PATH` | where the two secrets live |
 | `VAULT_STORE_NAME`, `VAULT_APPROLE_SECRET` | the `ClusterSecretStore` this creates, and the AppRole Secret in `external-secrets` it authenticates with |
-| `EXTRA_ENV_SECRET` | a Secret whose keys become environment variables for workflows. Optional in intent — supply an empty Secret if there is nothing |
+| `EXTRA_ENV_SECRET`, `EXTRA_ENV_SECRET_2` | Secrets whose keys become environment variables for workflows. Two slots, because a deployment's environment usually comes from more than one owner. Both `optional`, so an unused slot needs no placeholder |
 | `EXTRA_CA_CONFIGMAP` | a ConfigMap with `ca.crt`, mounted and set as `NODE_EXTRA_CA_CERTS`, so workflows can call internal TLS endpoints without verification being disabled. Marked `optional`, so an absent one is not an error |
 | `BLOCK_ENV_ACCESS` | `"true"` blocks `$env` in workflow expressions. n8n's default, and the right one wherever more than one team writes workflows: any workflow can otherwise read any variable in the pod. `"false"` is how a secret reaches a workflow without being committed in its JSON |
 | `EXECUTIONS_MAX_AGE_HOURS` | how long executions are kept. n8n keeps them for ever by default, which turns the database into a log |
diff --git a/k8s/n8n/deployment.yaml b/k8s/n8n/deployment.yaml
index f945c9d..5f26b9c 100644
--- a/k8s/n8n/deployment.yaml
+++ b/k8s/n8n/deployment.yaml
@@ -78,8 +78,17 @@ spec:
             # Whatever else this deployment's workflows need in their
             # environment. Provided by the deployment, not by this repo: an
             # empty Secret of that name is a valid answer.
+            #
+            # Two slots rather than one, because a deployment's environment
+            # usually comes from more than one owner — credentials the platform
+            # holds, and credentials a workflow's own estate holds. Both are
+            # marked optional, so an unused slot needs no placeholder Secret.
             - secretRef:
                 name: ${EXTRA_ENV_SECRET}
+                optional: true
+            - secretRef:
+                name: ${EXTRA_ENV_SECRET_2}
+                optional: true
           volumeMounts:
             - name: data
               mountPath: /home/node/.n8n