diff --git a/SECRETS.md b/SECRETS.md
index cf70fa3..e74c10a 100644
--- a/SECRETS.md
+++ b/SECRETS.md
@@ -21,6 +21,7 @@ Live passwords/keys live in sibling **`koopa-admin-secrets`**.
 | Bonfire (`FEDERATE=true`) | `koopa/home-hernani/koopa-bonfire/{.env,users.env,compose.yml}` | `~/koopa-bonfire/` |
 | Prime (Jellyfin + qBittorrent) | `koopa/home-hernani/koopa-prime/{.env,users.env}` | `~/koopa-prime/` |
 | Forgejo (**rootless**, git.hacktivism.ch) | `koopa/home-hernani/koopa-forgejo/{.env,users.env,compose.yml}` | `~/koopa-forgejo/` |
+| Paivana (GOA paywall) | `koopa/home-hernani/koopa-paivana/secrets/*` | `~/koopa-paivana/secrets/` |
 
 ## Rules
 
diff --git a/configs/paivana/secrets/README.md b/configs/paivana/secrets/README.md
new file mode 100644
index 0000000..9581cbc
--- /dev/null
+++ b/configs/paivana/secrets/README.md
@@ -0,0 +1,13 @@
+# Secrets — not stored in admin-log
+
+Live on koopa (`hernani`):
+
+```
+~/koopa-paivana/secrets/merchant-access-token   # secret-token:<goa-shop password>
+~/koopa-paivana/secrets/paivana-secret          # openssl rand -hex 32
+```
+
+Mode: world-readable to the container user is required under rootless podman
+(`chmod 644` is fine; directory stays under hernani home).
+
+Optional mirror under `koopa-admin-secrets/koopa/home-hernani/koopa-paivana/secrets/`.
diff --git a/configs/paivana/secrets/merchant-access-token.example b/configs/paivana/secrets/merchant-access-token.example
new file mode 100644
index 0000000..5094f90
--- /dev/null
+++ b/configs/paivana/secrets/merchant-access-token.example
@@ -0,0 +1 @@
+secret-token:REPLACE-WITH-GOA-SHOP-INSTANCE-PASSWORD