diff --git a/README.md b/README.md
index ba3c22f..4440b8a 100644
--- a/README.md
+++ b/README.md
@@ -86,16 +86,20 @@ Visit `http://ignis.fireflylab.local` once the pod is Ready.
 - No HTTPRoute — this only serves `/metrics`. A `ServiceMonitor` (labeled
   `release: kube-prometheus-stack` to match that stack's default selector)
   gets it scraped by the cluster Prometheus instead.
-- `ACTUAL_PASSWORD` / `ACTUAL_BUDGET_ID_1` are **not** in `values.yaml` —
-  plaintext Actual credentials don't belong in a git-committed file. They
-  come from a Secret you create by hand once, after the Application syncs
-  and the `actualbudget` namespace exists:
+- `ACTUAL_PASSWORD` / `ACTUAL_BUDGET_ID_1` / `ACTUAL_E2E_PASSWORD_1` are
+  **not** in `values.yaml` — plaintext Actual credentials don't belong in a
+  git-committed file. They come from a Secret you create by hand once, after
+  the Application syncs and the `actualbudget` namespace exists.
+  `ACTUAL_E2E_PASSWORD_1` is required if the budget has E2E encryption
+  enabled — the exporter fails with `File ... is encrypted. Please provide a
+  password.` otherwise; pass an empty string if the budget isn't encrypted:
 
   ```bash
   kubectl create secret generic actual-budget-exporter-secrets \
     -n actualbudget \
     --from-literal=ACTUAL_PASSWORD='<your actual budget password>' \
-    --from-literal=ACTUAL_BUDGET_ID_1='<sync ID from Settings → Show advanced settings>'
+    --from-literal=ACTUAL_BUDGET_ID_1='<sync ID from Settings → Show advanced settings>' \
+    --from-literal=ACTUAL_E2E_PASSWORD_1='<E2E encryption password, empty string if none>'
   ```
 
   Restart the deployment after creating/rotating it:
diff --git a/apps/actual-budget-exporter/chart/templates/deployment.yaml b/apps/actual-budget-exporter/chart/templates/deployment.yaml
index 0bb282e..7a223dc 100644
--- a/apps/actual-budget-exporter/chart/templates/deployment.yaml
+++ b/apps/actual-budget-exporter/chart/templates/deployment.yaml
@@ -34,6 +34,11 @@ spec:
                 secretKeyRef:
                   name: {{ .Values.secret.name }}
                   key: ACTUAL_BUDGET_ID_1
+            - name: ACTUAL_E2E_PASSWORD_1
+              valueFrom:
+                secretKeyRef:
+                  name: {{ .Values.secret.name }}
+                  key: ACTUAL_E2E_PASSWORD_1
           resources:
             {{- toYaml .Values.resources | nindent 12 }}
           # No documented dedicated health endpoint; /metrics is the route
diff --git a/apps/actual-budget-exporter/chart/values.yaml b/apps/actual-budget-exporter/chart/values.yaml
index 34b953a..c255d88 100644
--- a/apps/actual-budget-exporter/chart/values.yaml
+++ b/apps/actual-budget-exporter/chart/values.yaml
@@ -15,11 +15,13 @@ service:
 env:
   ACTUAL_SERVER_URL: "http://192.168.1.41:8002"
   # ACTUAL_BUDGET_NAME_1: ""    # optional, adds a friendly name to the prometheus label
-  # ACTUAL_E2E_PASSWORD_1: ""   # optional, only if E2E encryption is enabled on the budget
 
-# ACTUAL_PASSWORD and ACTUAL_BUDGET_ID_1 are NOT set here — plaintext Actual
-# credentials in a git-committed values.yaml is not acceptable. They're read
-# from a Secret you create by hand once (see README.md), never committed.
+# ACTUAL_PASSWORD, ACTUAL_BUDGET_ID_1, and ACTUAL_E2E_PASSWORD_1 are NOT set
+# here — plaintext Actual credentials don't belong in a git-committed
+# values.yaml. They're read from a Secret you create by hand once (see
+# README.md), never committed. ACTUAL_E2E_PASSWORD_1 is required whenever the
+# budget has E2E encryption enabled (exporter fails with "File ... is
+# encrypted" otherwise) — leave the key empty in the Secret if it isn't.
 secret:
   name: actual-budget-exporter-secrets