diff --git a/firmware/.env.example b/firmware/.env.example
index 442db89..1bb6f35 100644
--- a/firmware/.env.example
+++ b/firmware/.env.example
@@ -13,5 +13,13 @@ TW_WIFI_PASS=your-password
 # Note: the spike assumes WPA2-Personal. Open network → leave TW_WIFI_PASS empty.
 # A WPA3-only AP needs AuthMethod::WPA3Personal in src/bin/wifi_tls.rs.
 
-# Spike 7 (gitoxide push) will add: TW_REMOTE_URL, TW_GH_USER, TW_PAT,
-# TW_AUTHOR_NAME, TW_AUTHOR_EMAIL.
+# Spike 7 — on-device git push (`just flash-git-push`, src/bin/git_push.rs).
+# HTTPS + PAT auth (ADR-005); baked into the git_push image at build time and
+# never logged. Point TW_REMOTE_URL at a THROWAWAY test repo — the spike pushes
+# a fresh `device/<unix>` branch on every boot.
+TW_REMOTE_URL=https://github.com/you/typoena-test.git
+TW_GH_USER=your-github-username
+TW_PAT=ghp_xxxxxxxxxxxxxxxxxxxx
+# Commit author (message is a timestamp).
+TW_AUTHOR_NAME=Typoena
+TW_AUTHOR_EMAIL=typoena@example.com
diff --git a/firmware/build.rs b/firmware/build.rs
index 981cf65..44adf72 100644
--- a/firmware/build.rs
+++ b/firmware/build.rs
@@ -27,7 +27,21 @@ fn main() {
     // them in with env!(). Empty when unset: the network spike checks at
     // runtime and prints a clear message, so the *editor* build never has to
     // carry Wi-Fi creds. Source them from firmware/.env (loaded by `just`).
-    for var in ["TW_WIFI_SSID", "TW_WIFI_PASS"] {
+    //
+    // The TW_REMOTE_URL / TW_GH_USER / TW_PAT / TW_AUTHOR_* vars back Spike 7's
+    // on-device push (src/bin/git_push.rs). env!() embeds a value only in a
+    // binary that references it, so the editor binary carries none of these.
+    // NOTE: TW_PAT ends up in the git_push image — fine for the bench spike, but
+    // a product must not bake the PAT into flash (ADR-005).
+    for var in [
+        "TW_WIFI_SSID",
+        "TW_WIFI_PASS",
+        "TW_REMOTE_URL",
+        "TW_GH_USER",
+        "TW_PAT",
+        "TW_AUTHOR_NAME",
+        "TW_AUTHOR_EMAIL",
+    ] {
         let val = std::env::var(var).unwrap_or_default();
         println!("cargo:rustc-env={var}={val}");
         println!("cargo:rerun-if-env-changed={var}");