diff --git a/docs/secrets-and-pki.md b/docs/secrets-and-pki.md
index c3bf010..6f04c36 100644
--- a/docs/secrets-and-pki.md
+++ b/docs/secrets-and-pki.md
@@ -68,6 +68,7 @@ Every Vault Agent reaches Vault through the internal app-to-app proxy zone descr
 | User-Facing Proxy | Server + client certs for the mTLS-enforced browser zone, plus a shared registry-token render and Hawser's application secret |
 | Internal DNS | Server cert for its own admin UI/API only |
 | Security Monitoring | Its manager and dashboard services' shared secrets (indexer, API, dashboard passwords), plus Hawser's application secret, plus a shared registry-token render |
+| NetBird | Its entire server config rendered as one file, embedded secrets included — the same file-templating pattern used for Kestra's `application.yml` — plus Hawser's application secret, plus a shared registry-token render |
 
 None of these ever call the Vault API themselves — every one of them goes through the same local-render sequence: