diff --git a/secretstores/toolshed-jenkins-credentials.yaml b/secretstores/toolshed-jenkins-credentials.yaml
new file mode 100644
index 0000000..f1c5c23
--- /dev/null
+++ b/secretstores/toolshed-jenkins-credentials.yaml
@@ -0,0 +1,46 @@
+# Jenkins API credentials for toolshed's builder.
+#
+# builder holds these and nothing else — no Kubernetes access, no session
+# signing key. It is the service that talks to an external system over HTTP
+# with long-running operations, so it is also the one most likely to hang or
+# crash; keeping its blast radius to "can drive Jenkins" is deliberate.
+#
+# Use a dedicated Jenkins user rather than the admin account, with an API
+# token rather than a password. Jenkins issues tokens under
+# <user> -> Configure -> API Token -> Add new Token, and shows the value
+# exactly once.
+#
+# The user needs Job/Create as well as Job/Build and Job/Read: builder creates
+# an app's job the first time it deploys, which is what guarantees the SCM
+# polling trigger is present. Without that trigger a webhook can never find
+# the job no matter how exactly the repository URL matches (claude.md issue
+# #30) — creating jobs through the API is what stops that being something a
+# person has to remember.
+#
+#   kubectl -n vault exec -i vault-0 -- sh -lc '
+#     vault login <root-token> >/dev/null &&
+#     vault kv put secret/toolshed/jenkins \
+#       username=<jenkins user> \
+#       token=<api token>'
+apiVersion: external-secrets.io/v1
+kind: ExternalSecret
+metadata:
+  name: toolshed-jenkins
+  namespace: toolshed
+spec:
+  refreshInterval: 1h
+  secretStoreRef:
+    name: vault-backend
+    kind: ClusterSecretStore
+  target:
+    name: toolshed-jenkins
+    creationPolicy: Owner
+  data:
+    - secretKey: username
+      remoteRef:
+        key: toolshed/jenkins
+        property: username
+    - secretKey: token
+      remoteRef:
+        key: toolshed/jenkins
+        property: token