diff --git a/VERSION b/VERSION
index 4daf42f..76cab36 100644
--- a/VERSION
+++ b/VERSION
@@ -1 +1 @@
-0.27.1
\ No newline at end of file
+0.27.2
\ No newline at end of file
diff --git a/scripts/deploy.sh b/scripts/deploy.sh
index a02ccea..a109770 100755
--- a/scripts/deploy.sh
+++ b/scripts/deploy.sh
@@ -58,7 +58,9 @@ done
 
 # 7. Seed secrets into Infisical (idempotent)
 echo "[7/7] seed secrets"
-docker compose exec -T api oikos secret list > /dev/null 2>&1 && \
-    docker compose cp scripts/seed-secrets.sh api:/opt/oikos/scripts/seed-secrets.sh 2>/dev/null && \
-    docker compose exec -T api /opt/oikos/scripts/seed-secrets.sh || \
-    echo "WARNING: secret seeding skipped (infisical not reachable)"
+if [ -f "$REPO_DIR/scripts/seed-secrets.sh" ]; then
+    REPO_DIR="$REPO_DIR" sh "$REPO_DIR/scripts/seed-secrets.sh" || \
+        echo "WARNING: secret seeding failed"
+else
+    echo "SKIP: seed-secrets.sh not found"
+fi
diff --git a/scripts/seed-secrets.sh b/scripts/seed-secrets.sh
index 675521e..57d143b 100755
--- a/scripts/seed-secrets.sh
+++ b/scripts/seed-secrets.sh
@@ -1,44 +1,57 @@
 #!/bin/sh
-# One-shot: populate Infisical with oikos secrets from env vars.
-# Designed to run inside the oikos-api container where Infisical is reachable.
+# One-shot: populate Infisical with oikos secrets from host .env.
+# Runs on the deploy host (mac-mini) where docker-compose reads .env.
+# Uses the oikos binary from the repo to talk to Infisical on localhost:8080.
+#
+# Usage: ./scripts/seed-secrets.sh
+#
 # Safe to re-run (set is idempotent).
-#
-# Usage: docker exec oikos-api-1 /opt/oikos/scripts/seed-secrets.sh
-#
-# Secrets are read from the container environment (set via docker-compose).
-# If a secret is already in Infisical, it is updated in place.
 
 set -e
 
+SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
+REPO_DIR="${REPO_DIR:-$SCRIPT_DIR/..}"
+OIKOS_BIN="${OIKOS_BIN:-$REPO_DIR/bin/oikos}"
+
+export OIKOS_INFISICAL_SITE_URL="${OIKOS_INFISICAL_SITE_URL:-http://localhost:8080}"
+export OIKOS_INFISICAL_ENV="${OIKOS_INFISICAL_ENV:-dev}"
+
 echo "=== seed-secrets: $(date) ==="
 
-KEYS="
-matrix_token:${OIKOS_MATRIX_TOKEN:-}
-approval_hmac-secret:${OIKOS_APPROVAL_HMAC_SECRET:-}
-mcp_bearer-token:${OIKOS_MCP_BEARER_TOKEN:-}
-api_token:${OIKOS_API_TOKEN:-}
-oidc_client-secret:${OIKOS_OIDC_CLIENT_SECRET:-}
-openrouter_api-key:${OPENROUTER_API_KEY:-}
-webhook_hmac-secret:${WEBHOOK_HMAC_SECRET:-}
-"
+if [ ! -x "$OIKOS_BIN" ]; then
+    echo "Building oikos binary..."
+    (cd "$REPO_DIR" && go build -o "$OIKOS_BIN" ./cmd/oikos/)
+fi
 
 set_count=0
 skip_count=0
+fail_count=0
 
-echo "$KEYS" | while IFS=: read -r key value; do
-    [ -z "$key" ] && continue
+seed_key() {
+    key="$1"
+    env_var="$2"
+    value="$(eval echo \"\${$env_var:-}\")"
     if [ -z "$value" ]; then
-        echo "SKIP: $key (env var empty/missing)"
+        echo "SKIP: $key ($env_var empty/missing)"
         skip_count=$((skip_count + 1))
-        continue
+        return
     fi
-    if oikos secret set "$key" "$value" 2>/dev/null; then
+    if "$OIKOS_BIN" secret set "$key" "$value" 2>/dev/null; then
         echo "SET:  $key"
         set_count=$((set_count + 1))
     else
         echo "FAIL: $key"
+        fail_count=$((fail_count + 1))
     fi
-done
+}
+
+seed_key "matrix_token"         "OIKOS_MATRIX_TOKEN"
+seed_key "approval_hmac-secret" "OIKOS_APPROVAL_HMAC_SECRET"
+seed_key "mcp_bearer-token"     "OIKOS_MCP_BEARER_TOKEN"
+seed_key "api_token"            "OIKOS_API_TOKEN"
+seed_key "oidc_client-secret"   "OIKOS_OIDC_CLIENT_SECRET"
+seed_key "openrouter_api-key"   "OPENROUTER_API_KEY"
+seed_key "webhook_hmac-secret"  "WEBHOOK_HMAC_SECRET"
 
 echo ""
-echo "seed-secrets complete: $set_count set, $skip_count skipped"
+echo "seed-secrets complete: $set_count set, $skip_count skipped, $fail_count failed"