diff --git a/.env.example b/.env.example
index 6dcfb1e..4d657cc 100644
--- a/.env.example
+++ b/.env.example
@@ -26,3 +26,8 @@ TURNSTILE_SECRET_KEY=1x0000000000000000000000000000000AA
 CLOUDINARY_CLOUD_NAME=""
 CLOUDINARY_API_KEY=""
 CLOUDINARY_API_SECRET=""
+
+# Shared secret for cron job endpoints (POST /admin/jobs/*).
+# Must match the CRON_SECRET repo secret in Forgejo.
+# Generate with: openssl rand -hex 32
+CRON_SECRET=""