diff --git a/README.md b/README.md
index d3ae72b..69481c0 100644
--- a/README.md
+++ b/README.md
@@ -40,6 +40,18 @@ paths:
     subscribe_secret: "token-for-docketeer-subscribers"
 ```
 
+Values support environment variable interpolation via `$VAR` or `${VAR}`
+syntax, so secrets can come from the environment rather than being hardcoded:
+
+```yaml
+paths:
+  github.com/chrisguidry/docketeer:
+    verify: hmac-sha256
+    secret: "${WEBHOOK_SECRET}"
+    signature_header: X-Hub-Signature-256
+    subscribe_secret: "${SUBSCRIBE_TOKEN}"
+```
+
 - Unconfigured paths accept POSTs without verification
 - Configured paths verify webhook signatures and reject invalid ones
 - Subscribe secrets require `Authorization: Bearer <token>` for SSE connections