diff --git a/VERSION b/VERSION
index 49f074d..6ca8061 100644
--- a/VERSION
+++ b/VERSION
@@ -1 +1 @@
-0.27.4
\ No newline at end of file
+0.27.5
\ No newline at end of file
diff --git a/docker-compose.yml b/docker-compose.yml
index a7210c1..b7595d1 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -144,6 +144,11 @@ services:
       OIKOS_MATRIX_USER: ${OIKOS_MATRIX_USER:-@hermes:hubris.network}
       OIKOS_MATRIX_TOKEN: ${OIKOS_MATRIX_TOKEN}
       OIKOS_MATRIX_ROOM: ${OIKOS_MATRIX_ROOM:-!alerts:hubris.network}
+      OIKOS_INFISICAL_SITE_URL: ${OIKOS_INFISICAL_SITE_URL:-}
+      OIKOS_INFISICAL_CLIENT_ID: ${OIKOS_INFISICAL_CLIENT_ID:-}
+      OIKOS_INFISICAL_CLIENT_SECRET: ${OIKOS_INFISICAL_CLIENT_SECRET:-}
+      OIKOS_INFISICAL_PROJECT_ID: ${OIKOS_INFISICAL_PROJECT_ID:-}
+      OIKOS_INFISICAL_ENV: ${OIKOS_INFISICAL_ENV:-dev}
     command: ["notifier"]
     stop_signal: SIGTERM
     stop_grace_period: 30s
@@ -172,6 +177,13 @@ services:
       # Must match api's OIKOS_MCP_BEARER_TOKEN above — api's combinedAuth
       # rejects every request without it now (no dev-open bypass).
       OIKOS_MCP_BEARER_TOKEN: ${OIKOS_MCP_BEARER_TOKEN:-dev-token}
+      # Infisical secret store (Phase 5) — nomos resolves mcp_bearer-token
+      # and openrouter_api-key from here, overriding the env values above.
+      OIKOS_INFISICAL_SITE_URL: ${OIKOS_INFISICAL_SITE_URL:-}
+      OIKOS_INFISICAL_CLIENT_ID: ${OIKOS_INFISICAL_CLIENT_ID:-}
+      OIKOS_INFISICAL_CLIENT_SECRET: ${OIKOS_INFISICAL_CLIENT_SECRET:-}
+      OIKOS_INFISICAL_PROJECT_ID: ${OIKOS_INFISICAL_PROJECT_ID:-}
+      OIKOS_INFISICAL_ENV: ${OIKOS_INFISICAL_ENV:-dev}
     ports:
       - "8092:8092"
     stop_signal: SIGTERM