diff --git a/secretstores/quant-agent-anthropic.yaml b/secretstores/quant-agent-anthropic.yaml
new file mode 100644
index 0000000..6c2e8af
--- /dev/null
+++ b/secretstores/quant-agent-anthropic.yaml
@@ -0,0 +1,27 @@
+# Anthropic API key for quant-agent's Claude review stage.
+#
+# Without this the agent still runs — it logs the absence at startup and
+# operates as a pure quantitative strategy, with every filter and risk
+# limit still enforced. It simply never asks Claude for a second opinion.
+#
+# One-time setup:
+#   kubectl -n vault exec -i vault-0 -- \
+#     vault kv put secret/quant-agent/anthropic apiKey="sk-ant-..."
+apiVersion: external-secrets.io/v1
+kind: ExternalSecret
+metadata:
+  name: quant-agent-anthropic
+  namespace: quant-agent
+spec:
+  refreshInterval: 1h
+  secretStoreRef:
+    name: vault-backend
+    kind: ClusterSecretStore
+  target:
+    name: quant-agent-anthropic
+    creationPolicy: Owner
+  data:
+    - secretKey: apiKey
+      remoteRef:
+        key: quant-agent/anthropic
+        property: apiKey
diff --git a/secretstores/quant-agent-kite.yaml b/secretstores/quant-agent-kite.yaml
new file mode 100644
index 0000000..c9501f4
--- /dev/null
+++ b/secretstores/quant-agent-kite.yaml
@@ -0,0 +1,41 @@
+# Zerodha Kite Connect credentials for quant-agent.
+#
+# Entirely optional. With no apiKey present the agent uses its built-in
+# simulated NSE feed, which is what lets the whole system run with no
+# broker account.
+#
+# The access token is the awkward one: Kite tokens are single-session
+# and expire every trading day around 06:00 IST, and minting a new one
+# requires an interactive browser redirect that cannot be automated from
+# inside a pod. Two options, neither automatic:
+#   - re-run the vault kv put below each morning, or
+#   - paste the fresh token into the agent's UI, which applies it live
+#     without a restart (POST /api/kite-token).
+#
+# One-time setup:
+#   kubectl -n vault exec -i vault-0 -- \
+#     vault kv put secret/quant-agent/kite apiKey="..." accessToken="..."
+apiVersion: external-secrets.io/v1
+kind: ExternalSecret
+metadata:
+  name: quant-agent-kite
+  namespace: quant-agent
+spec:
+  # Shorter than the usual 1h so a token refreshed in Vault mid-morning
+  # reaches the pod reasonably quickly.
+  refreshInterval: 15m
+  secretStoreRef:
+    name: vault-backend
+    kind: ClusterSecretStore
+  target:
+    name: quant-agent-kite
+    creationPolicy: Owner
+  data:
+    - secretKey: apiKey
+      remoteRef:
+        key: quant-agent/kite
+        property: apiKey
+    - secretKey: accessToken
+      remoteRef:
+        key: quant-agent/kite
+        property: accessToken