diff --git a/VERSION b/VERSION
index 76cab36..d0ca6fd 100644
--- a/VERSION
+++ b/VERSION
@@ -1 +1 @@
-0.27.2
\ No newline at end of file
+0.27.3
\ No newline at end of file
diff --git a/cmd/oikos/main.go b/cmd/oikos/main.go
index c3551bf..7257585 100644
--- a/cmd/oikos/main.go
+++ b/cmd/oikos/main.go
@@ -64,7 +64,7 @@ func main() {
 
 		secrets.VerifyExpectedSecrets(ctx, sec, []string{
 			"matrix_token", "approval_hmac-secret", "mcp_bearer-token",
-			"api_token", "oidc_client-secret", "openrouter_api-key", "webhook_hmac-secret",
+			"api_token", "openrouter_api-key", "webhook_hmac-secret",
 		})
 	}
 
@@ -385,7 +385,6 @@ var expectedSecrets = []string{
 	"approval_hmac-secret",
 	"mcp_bearer-token",
 	"api_token",
-	"oidc_client-secret",
 	"openrouter_api-key",
 	"webhook_hmac-secret",
 }
diff --git a/scripts/seed-secrets.sh b/scripts/seed-secrets.sh
index 57d143b..74529df 100755
--- a/scripts/seed-secrets.sh
+++ b/scripts/seed-secrets.sh
@@ -1,7 +1,8 @@
 #!/bin/sh
-# One-shot: populate Infisical with oikos secrets from host .env.
-# Runs on the deploy host (mac-mini) where docker-compose reads .env.
-# Uses the oikos binary from the repo to talk to Infisical on localhost:8080.
+# One-shot: populate Infisical with oikos secrets.
+# Extracts secret values from running containers (where docker-compose
+# injects them from the host .env) and pushes them into Infisical via
+# the api container's oikos binary.
 #
 # Usage: ./scripts/seed-secrets.sh
 #
@@ -11,32 +12,29 @@ set -e
 
 SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
 REPO_DIR="${REPO_DIR:-$SCRIPT_DIR/..}"
-OIKOS_BIN="${OIKOS_BIN:-$REPO_DIR/bin/oikos}"
-
-export OIKOS_INFISICAL_SITE_URL="${OIKOS_INFISICAL_SITE_URL:-http://localhost:8080}"
-export OIKOS_INFISICAL_ENV="${OIKOS_INFISICAL_ENV:-dev}"
+COMPOSE="docker compose -f $REPO_DIR/docker-compose.yml"
 
 echo "=== seed-secrets: $(date) ==="
 
-if [ ! -x "$OIKOS_BIN" ]; then
-    echo "Building oikos binary..."
-    (cd "$REPO_DIR" && go build -o "$OIKOS_BIN" ./cmd/oikos/)
-fi
-
 set_count=0
 skip_count=0
 fail_count=0
 
+get_container_env() {
+    service="$1"
+    var="$2"
+    $COMPOSE exec -T "$service" printenv "$var" 2>/dev/null || true
+}
+
 seed_key() {
     key="$1"
-    env_var="$2"
-    value="$(eval echo \"\${$env_var:-}\")"
+    value="$2"
     if [ -z "$value" ]; then
-        echo "SKIP: $key ($env_var empty/missing)"
+        echo "SKIP: $key (empty)"
         skip_count=$((skip_count + 1))
         return
     fi
-    if "$OIKOS_BIN" secret set "$key" "$value" 2>/dev/null; then
+    if $COMPOSE exec -T api oikos secret set "$key" "$value" 2>/dev/null; then
         echo "SET:  $key"
         set_count=$((set_count + 1))
     else
@@ -45,13 +43,20 @@ seed_key() {
     fi
 }
 
-seed_key "matrix_token"         "OIKOS_MATRIX_TOKEN"
-seed_key "approval_hmac-secret" "OIKOS_APPROVAL_HMAC_SECRET"
-seed_key "mcp_bearer-token"     "OIKOS_MCP_BEARER_TOKEN"
-seed_key "api_token"            "OIKOS_API_TOKEN"
-seed_key "oidc_client-secret"   "OIKOS_OIDC_CLIENT_SECRET"
-seed_key "openrouter_api-key"   "OPENROUTER_API_KEY"
-seed_key "webhook_hmac-secret"  "WEBHOOK_HMAC_SECRET"
+matrix_token="$(get_container_env notifier OIKOS_MATRIX_TOKEN)"
+approval_hmac="$(get_container_env notifier OIKOS_APPROVAL_HMAC_SECRET)"
+mcp_token="$(get_container_env api OIKOS_MCP_BEARER_TOKEN)"
+openrouter_key="$(get_container_env nomos OPENROUTER_API_KEY)"
+webhook_hmac="$(get_container_env api WEBHOOK_HMAC_SECRET 2>/dev/null)"
+
+api_token="$mcp_token"
+
+seed_key "matrix_token"         "$matrix_token"
+seed_key "approval_hmac-secret" "$approval_hmac"
+seed_key "mcp_bearer-token"     "$mcp_token"
+seed_key "api_token"            "$api_token"
+seed_key "openrouter_api-key"   "$openrouter_key"
+seed_key "webhook_hmac-secret"  "$webhook_hmac"
 
 echo ""
 echo "seed-secrets complete: $set_count set, $skip_count skipped, $fail_count failed"