diff --git a/zsh/zshrc b/zsh/zshrc
index 9e505ff..7d0509a 100644
--- a/zsh/zshrc
+++ b/zsh/zshrc
@@ -33,3 +33,8 @@ HISTSIZE=10000
 SAVEHIST=10000
 setopt SHARE_HISTORY
 setopt HIST_IGNORE_DUPS
+
+# Per-machine customizations (secrets, keys, local overrides) live in
+# ~/.zshrc.local, which bootstrap never touches. See zsh/zshrc.local.example
+# for the variables modules look for. Loaded last so it can override anything.
+[ -f "$HOME/.zshrc.local" ] && source "$HOME/.zshrc.local"
diff --git a/zsh/zshrc.local.example b/zsh/zshrc.local.example
new file mode 100644
index 0000000..c8cfbd8
--- /dev/null
+++ b/zsh/zshrc.local.example
@@ -0,0 +1,26 @@
+# ~/.zshrc.local — per-machine customizations. Copy this file to
+# ~/.zshrc.local and fill in what this box needs. It is sourced at the end
+# of the managed ~/.zshrc, is never overwritten by bootstrap, and never
+# lives in the repo — this is the ONLY place to put secrets.
+#
+#   cp zsh/zshrc.local.example ~/.zshrc.local && chmod 600 ~/.zshrc.local
+
+# --- Gitea -------------------------------------------------------------
+# Personal access token for git.nic-oconnor.com (API/CLI use; HTTPS git
+# auth itself goes through credential.helper store, see git/).
+# export GITEA_KEY=...
+
+# --- covert-gpt LiteLLM gateway -----------------------------------------
+# LITELLM_KEY is normally exported by mcp-config's sync hook from
+# ~/.config/mcp-sync/key — run mcp-config/install.sh once instead of
+# setting it here. Only set it here on a box without mcp-sync:
+# export LITELLM_KEY=sk-...
+
+# --- 1Password CLI -------------------------------------------------------
+# Service-account token for non-interactive `op read` / `op run`.
+# export OP_SERVICE_ACCOUNT_TOKEN=ops_...
+
+# --- Anything else -------------------------------------------------------
+# Aliases, PATH additions, kubeconfig defaults, etc. This file loads last,
+# so it can override anything the managed zshrc sets.
+# export KUBECONFIG="$HOME/.kube/homelab.yaml"