diff --git a/SECRETS.md b/SECRETS.md
index d5d77b9..3b6d709 100644
--- a/SECRETS.md
+++ b/SECRETS.md
@@ -22,6 +22,7 @@ Live passwords/keys live in sibling **`koopa-admin-secrets`**.
 | Prime (Jellyfin + qBittorrent) | `koopa/home-hernani/koopa-prime/{.env,users.env}` | `~/koopa-prime/` |
 | Forgejo (**rootless**, git.hacktivism.ch) | `koopa/home-hernani/koopa-forgejo/{.env,users.env,compose.yml}` | `~/koopa-forgejo/` |
 | Paivana (GOA paywall) | `koopa/home-hernani/koopa-paivana/secrets/*` | `~/koopa-paivana/secrets/` |
+| Nym (`koopa-nym`, nym.com) | `koopa/home-hernani/koopa-nym/.env` | `~/koopa-nym/.env` (+ `~/koopa-nym/data/` identity, host-only) |
 
 ## Rules
 
@@ -33,6 +34,3 @@ Live passwords/keys live in sibling **`koopa-admin-secrets`**.
 
 - `MASTER_PUBLIC_KEY` / merchant `MASTER_KEY` (exchange public master key)
 - Port maps, unit ladders, non-secret overrides
-
-| Nym node (`koopa-nym`) | `koopa/home-hernani/koopa-nym/` (data volume, wallet mnemonic if any) | `~/koopa-nym/data/` |
-
diff --git a/configs/firewalld/public-ports.md b/configs/firewalld/public-ports.md
index ee433d2..2ae7378 100644
--- a/configs/firewalld/public-ports.md
+++ b/configs/firewalld/public-ports.md
@@ -55,6 +55,8 @@ Forgejo advertises `SSH_PORT=9200`. Traffic hits **host:9200** (not Caddy). With
 
 ## History
 
+| 2026-07-16 | **1789/tcp+udp**, **1790/tcp**, **51822/udp** for Nym (`koopa-nym`) — open with firewall-cmd when node is live |
+
 | When | Change |
 |------|--------|
 | 2026-07-09 | 443/tcp re-added for IPv6 |
diff --git a/configs/nym/README.md b/configs/nym/README.md
index 94a2a78..55e089a 100644
--- a/configs/nym/README.md
+++ b/configs/nym/README.md
@@ -51,4 +51,11 @@ podman compose up -d   # or podman run …
 curl -sS http://127.0.0.1:9080/api/v1/roles | jq .
 ```
 
-Secrets / wallet mnemonics never live in this repo — see root `SECRETS.md`.
+Secrets layout (values in **koopa-admin-secrets**):
+
+| Live | Secrets mirror |
+|------|----------------|
+| `~/koopa-nym/.env` | `koopa-admin-secrets/koopa/home-hernani/koopa-nym/.env` |
+| `~/koopa-nym/data/` | host-only (node identity; not git) |
+
+Path map: `koopa-admin-log/SECRETS.md`.