diff --git a/CLAUDE.md b/CLAUDE.md
index 1d62eeb..00d956d 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -59,6 +59,12 @@ Secrets (needs the admin age key at `~/.config/sops/age/keys.txt`):
 ./scripts/edit_secrets secrets/<host>.yaml
 ```
 
+**Claude: never run `sops --decrypt`/`edit_secrets --show` and print the result — that
+puts every plaintext secret in the file into the conversation transcript, not just the
+one you wanted.** To add or change a single value non-interactively, use
+`sops --set '["key"] "value"' secrets/<host>.yaml` (quote the value as JSON), which
+writes without ever displaying the file's existing contents.
+
 Test a service config BEFORE touching hardware — always do this for nontrivial changes:
 ```
 # x86 QEMU VM of mercury's DNS/DHCP stack (fast; validates pihole/unbound at runtime)