diff --git a/deploy/thermograph.env.example b/deploy/thermograph.env.example
index 8110015..f73ed23 100644
--- a/deploy/thermograph.env.example
+++ b/deploy/thermograph.env.example
@@ -27,3 +27,15 @@ THERMOGRAPH_BASE=/
 # successful deploy, but only when the URL set changed (a new/removed city), so
 # code-only deploys don't resubmit. `make indexnow` forces a full submit.
 THERMOGRAPH_BASE_URL=https://thermograph.org
+
+# --- Web Push (VAPID) -----------------------------------------------------------
+# Keys that sign push notifications. If unset, the app generates a pair into
+# data/vapid.json on first run — fine as long as that file PERSISTS (it lives in the
+# writable data dir and survives deploys). PIN them here to be safe: if the keys ever
+# change, every existing browser subscription silently stops receiving (the push
+# service rejects with 401/403), and users must toggle alerts off/on to re-subscribe.
+# Generate a pair:  cd backend && ../.venv/bin/python -c "import push,json; k=push._generate(); print('PRIVATE=',k['private_key']); print('PUBLIC=',k['public_key'])"
+#THERMOGRAPH_VAPID_PRIVATE_KEY=
+#THERMOGRAPH_VAPID_PUBLIC_KEY=
+# Contact (mailto: or https URL) sent to push services in the VAPID claim.
+#THERMOGRAPH_VAPID_CONTACT=mailto:you@example.com