diff --git a/secretstores/toolshed-encryption-keys.yaml b/secretstores/toolshed-encryption-keys.yaml
new file mode 100644
index 0000000..d5814bc
--- /dev/null
+++ b/secretstores/toolshed-encryption-keys.yaml
@@ -0,0 +1,43 @@
+# The keys toolshed encrypts stored connection credentials with.
+#
+# Connections hold access to a customer's git server, registry and cloud.
+# Those are not toolshed's secrets to lose, so they are encrypted with a key
+# the database never contains — a dump of PostgreSQL must not hand over
+# somebody's infrastructure.
+#
+# Format is a comma-separated list of "id:base64key", most recent first. More
+# than one so rotation is not a flag day: values written with an older key
+# keep decrypting while new ones use the new key.
+#
+#   # generate a key
+#   kubectl -n toolshed exec deploy/toolshed-api -- /usr/local/bin/keygen  # session keys, not this
+#
+# Generate a 32-byte key any way you like; openssl is the shortest:
+#
+#   NEW=$(openssl rand -base64 32)
+#   kubectl -n vault exec -i vault-0 -- sh -lc "
+#     vault login <root-token> >/dev/null &&
+#     vault kv put secret/toolshed/encryption keys='k1:$NEW'"
+#
+# To rotate later, prepend a new key and keep the old one until nothing needs
+# it: keys='k2:<new>,k1:<old>'. Removing a key that still encrypts something
+# makes those credentials unreadable, and toolshed will say so by name rather
+# than reporting corruption.
+apiVersion: external-secrets.io/v1
+kind: ExternalSecret
+metadata:
+  name: toolshed-encryption
+  namespace: toolshed
+spec:
+  refreshInterval: 1h
+  secretStoreRef:
+    name: vault-backend
+    kind: ClusterSecretStore
+  target:
+    name: toolshed-encryption
+    creationPolicy: Owner
+  data:
+    - secretKey: keys
+      remoteRef:
+        key: toolshed/encryption
+        property: keys