diff --git a/monitoring/files/passwd b/monitoring/files/passwd
deleted file mode 100644
index 7f6e1b5..0000000
--- a/monitoring/files/passwd
+++ /dev/null
@@ -1,2 +0,0 @@
-esp8266:esp8266
-nodered:nodered
\ No newline at end of file
diff --git a/outline/files/.env b/outline/files/.env.j2
similarity index 100%
rename from outline/files/.env
rename to outline/files/.env.j2
diff --git a/outline/roles/outline/tasks/main.yaml b/outline/roles/outline/tasks/main.yaml
index 89a2c27..1d6b595 100644
--- a/outline/roles/outline/tasks/main.yaml
+++ b/outline/roles/outline/tasks/main.yaml
@@ -14,7 +14,7 @@
 
 - name: Upload the .env file
   template:
-    src: "files/.env"
+    src: "files/.env.j2"
     dest: "/var/lib/{{ host_directory }}/.env"
 
 - name: Create Outline container
diff --git a/sms-wa-bridge/readme.md b/sms-wa-bridge/readme.md
index 03b21c9..bfb4550 100644
--- a/sms-wa-bridge/readme.md
+++ b/sms-wa-bridge/readme.md
@@ -391,7 +391,7 @@ Then end to end, which is the only check that proves the whole path — and it
 ```bash
 curl -sS https://bridge.tanshu.dev/health
 curl -sS -X POST https://bridge.tanshu.dev/sms \
-  -H 'X-Auth: 64f205031acc01744b6edc23' \
+  -H "X-Auth: $AUTH_SECRET" \
   -H 'Content-Type: application/json' \
   -d '{"from":"HDFC Bank","text":"Your OTP is 123456"}'
 # sent x2
@@ -405,7 +405,7 @@ Finally, reboot the host and confirm the unit returns unattended — without
 ## Cutover
 
 One change on each phone: the MacroDroid HTTP action URL becomes
-`https://bridge.tanshu.dev/sms`. The header (`X-Auth: 64f205031acc01744b6edc23`)
+`https://bridge.tanshu.dev/sms`. The header `X-Auth: <auth_secret>`
 and the body (`{"from":"{sms_number}","text":"{sms_text}"}`) stay exactly as they
 are — the goal of the whole arrangement is that nothing else has to be touched.