diff --git a/README.md b/README.md
index 822e2a0..c612fca 100644
--- a/README.md
+++ b/README.md
@@ -45,29 +45,27 @@ helm version
 
 ---
 
-## Phase 2 — Set ArgoCD admin password
+## Phase 2 — Set credentials
 
-Install `httpd-tools` (one-time):
+Install tools (one-time):
 
 ```bash
-sudo dnf install -y httpd-tools
+sudo dnf install -y httpd-tools gettext
 ```
 
-Generate bcrypt hash and paste it into `manifests/argocd/values.yaml` under `configs.secret.argocdServerAdminPassword`:
+Copy and fill in `.env`:
+
+```bash
+cp .env.example .env
+```
+
+Generate bcrypt hash and set it in `.env`:
 
 ```bash
 htpasswd -nbBC 10 "" YOUR_PASSWORD | tr -d ':\n' | sed 's/$2y/$2a/'
 ```
 
-Commit the updated values:
-
-```bash
-git add manifests/argocd/values.yaml && git commit -m "set argocd admin password hash"
-```
-
-```bash
-git push origin main
-```
+`.env` is gitignored — never commit it.
 
 ---
 
@@ -83,10 +81,14 @@ helm repo add argo https://argoproj.github.io/argo-helm
 helm repo update
 ```
 
-Install ArgoCD:
+Install ArgoCD (`envsubst` fills `$ARGOCD_ADMIN_PASSWORD_HASH` from `.env` before helm reads the values):
 
 ```bash
-helm install argocd argo/argo-cd -n argocd --create-namespace -f manifests/argocd/values.yaml
+source .env
+```
+
+```bash
+envsubst < manifests/argocd/values.yaml | helm install argocd argo/argo-cd -n argocd --create-namespace -f -
 ```
 
 Wait for ArgoCD to be ready:
diff --git a/manifests/argocd/values.yaml b/manifests/argocd/values.yaml
index 4653e59..76fa242 100644
--- a/manifests/argocd/values.yaml
+++ b/manifests/argocd/values.yaml
@@ -19,8 +19,7 @@ configs:
   params:
     server.insecure: true   # TLS terminated at Envoy Gateway
   secret:
-    # Generate: htpasswd -nbBC 10 "" PASSWORD | tr -d ':\n' | sed 's/$2y/$2a/'
-    argocdServerAdminPassword: ""
+    argocdServerAdminPassword: "$ARGOCD_ADMIN_PASSWORD_HASH"
     argocdServerAdminPasswordMtime: "2025-01-01T00:00:00Z"
 
 server: