diff --git a/.gitignore b/.gitignore
index 7a2a95d..e680c87 100644
--- a/.gitignore
+++ b/.gitignore
@@ -14,3 +14,5 @@ bin/hermes
 # commands (ssh, pct, logs, restart, status, open, secret, client, sync, mcp).
 # Remove oikos/* when bin/homelab is ported to Go.
 backups/
+.env
+.infisical-credentials
diff --git a/scripts/cutover-checklist.md b/scripts/cutover-checklist.md
index c138ecc..9dddf51 100644
--- a/scripts/cutover-checklist.md
+++ b/scripts/cutover-checklist.md
@@ -9,7 +9,7 @@ Status: [x] = done, [ ] = pending
 - [x] **Deploy test**: Docker stack running with api + scheduler + notifier + hermes
 - [x] **Caddy config**: `compose/caddy/Caddyfile.oikos` pushed to `dtoro/caddy-conf` (ed20908). Auto-deploys to caddy (121).
 - [x] **DNS**: `oikos.hubris.network` already resolves to 192.168.8.175 (mac-mini mesh)
-- [ ] **Secrets**: Infisical not yet bootstrapped — blocked by Infisical v0.162.0 KMS migration bug (ERR_CRYPTO_INVALID_KEYLEN). SOPS fallback is active and working. Deferred pending upstream fix or version pin.
+- [x] **Secrets**: Infisical bootstrapped 2026-07-07 — running on `:8080` (profile: infisical). Admin account created (`oikos@hubris.network`). ENCRYPTION_KEY fix: must be 32-char raw string, NOT hex (Infisical docs incorrect). Next: complete org/project/machine-identity setup via browser at http://localhost:8080, then wire `OIKOS_SECRET_BACKEND=infisical` to oikos services.
 - [x] **Watchdog**: crontab entry added (every 2 min → `scripts/watchdog.sh`). Path fixed 2026-07-07 (was stale worktree path).
 
 ## Cutover