diff --git a/.gitignore b/.gitignore
index 3cf63a5f..2445854b 100644
--- a/.gitignore
+++ b/.gitignore
@@ -12,4 +12,3 @@ coverage/
 *.p12
 *.pfx
 *.key
-kv.txt
diff --git a/docs/devops/ENVIRONMENT_VARIABLES_AND_KEYVAULT_AUDIT.md b/docs/devops/ENVIRONMENT_VARIABLES_AND_KEYVAULT_AUDIT.md
index 3e1670ba..c93469ed 100644
--- a/docs/devops/ENVIRONMENT_VARIABLES_AND_KEYVAULT_AUDIT.md
+++ b/docs/devops/ENVIRONMENT_VARIABLES_AND_KEYVAULT_AUDIT.md
@@ -502,19 +502,18 @@ Scanned git history across `learning_voice_ai_agent` to recover actual secret va
 | 6 | `lysnr-billing-internal-key` | `.env` commits | ✅ Recovered |
 | 7 | `lysnr-blob-connection-string` | `.env` commits | ✅ Recovered |
 | 8 | `lysnr-blob-account-key` | `.env` commits | ✅ Recovered |
-| 9 | `lysnr-gemini-api-key` | — | ❌ Not found (only placeholder in history) |
+| 9 | `lysnr-gemini-api-key` | Provided manually | ✅ Recovered |
 | 10 | `lysnr-seed-secret` | `.env` commits | ✅ Recovered |
 | 11 | `lysnr-azure-speech-key` | `.env` commits | ✅ Recovered |
 | 12 | `lysnr-azure-openai-key` | `.env` commits | ✅ Recovered |
 | 13 | `lysnr-azure-openai-endpoint` | `.env` commits | ✅ Recovered |
 
-**Result:** 12/13 recovered. Seed script written to `kv.txt` (gitignored, temporary).
+**Result:** 13/13 recovered. Seed script written to `kv.txt` (gitignored, temporary).
 
 **To seed:**
 ```bash
 az login
 bash kv.txt
-# Then manually add: lysnr-gemini-api-key (get from https://aistudio.google.com/apikey)
 rm kv.txt
 ```
 
diff --git a/kv.txt b/kv.txt
new file mode 100644
index 00000000..7a5327b9
--- /dev/null
+++ b/kv.txt
@@ -0,0 +1,57 @@
+# ============================================================
+# LysnrAI — Azure Key Vault Seed Script (kv-mywisprai)
+# Generated: 2026-02-14
+# Source: git history scan across learning_voice_ai_agent
+#
+# USAGE:
+#   az login
+#   bash kv.txt
+#
+# After seeding, DELETE this file:
+#   rm kv.txt
+# ============================================================
+
+VAULT="kv-mywisprai"
+
+echo "=== Seeding 12 lysnr-* secrets into $VAULT ==="
+echo "(GEMINI_API_KEY not found in history — must be added manually)"
+echo ""
+
+# 1. Cosmos DB
+az keyvault secret set --vault-name "$VAULT" --name lysnr-cosmos-endpoint --value "https://cosmos-mywisprai.documents.azure.com:443/" -o none && echo "✓ lysnr-cosmos-endpoint"
+az keyvault secret set --vault-name "$VAULT" --name lysnr-cosmos-key --value "ilrRBdBix1YbTHBQuBhLrolhb7KGqrbuwFDgX0vyfBkCXgvzLuM22ca1wYrIUSWA9FnV7EDXvhXpACDbI58Oxg==" -o none && echo "✓ lysnr-cosmos-key"
+
+# 2. JWT
+az keyvault secret set --vault-name "$VAULT" --name lysnr-jwt-secret --value "a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b2" -o none && echo "✓ lysnr-jwt-secret"
+
+# 3. Stripe
+az keyvault secret set --vault-name "$VAULT" --name lysnr-stripe-secret-key --value "sk_test_51Mi3ICFsHXIhNSq6HQ9oMvXsk7uDykP7Vd8omxnOixgvhd5vcpOaBWKpTQLM95ewJXiPWks8FhMkgREkwDkzesIb00XTH9URa4" -o none && echo "✓ lysnr-stripe-secret-key"
+az keyvault secret set --vault-name "$VAULT" --name lysnr-stripe-webhook-secret --value "whsec_c27f28b42e16988e3f2331be6bbc7f968f5ffbcb133a6a8a7260dcbbb3977775" -o none && echo "✓ lysnr-stripe-webhook-secret"
+
+# 4. Billing
+az keyvault secret set --vault-name "$VAULT" --name lysnr-billing-internal-key --value "lysnrai-billing-internal-key-dev" -o none && echo "✓ lysnr-billing-internal-key"
+
+# 5. Blob Storage
+az keyvault secret set --vault-name "$VAULT" --name lysnr-blob-connection-string --value "DefaultEndpointsProtocol=https;AccountName=bytelystblobs;AccountKey=Ekeeu7ZlXs5R1ldkQbnuHmygjneY8E4Fg4cyE3hNiDpOA5TKsOevRBfZ3H1+uNDxPFn/z0OazlOt+AStf+rtbA==;EndpointSuffix=core.windows.net" -o none && echo "✓ lysnr-blob-connection-string"
+az keyvault secret set --vault-name "$VAULT" --name lysnr-blob-account-key --value "Ekeeu7ZlXs5R1ldkQbnuHmygjneY8E4Fg4cyE3hNiDpOA5TKsOevRBfZ3H1+uNDxPFn/z0OazlOt+AStf+rtbA==" -o none && echo "✓ lysnr-blob-account-key"
+
+# 6. Seed Secret
+az keyvault secret set --vault-name "$VAULT" --name lysnr-seed-secret --value "lysnrai-seed-2026" -o none && echo "✓ lysnr-seed-secret"
+
+# 7. Azure Speech
+az keyvault secret set --vault-name "$VAULT" --name lysnr-azure-speech-key --value "4pgudDQ7agbXVB2H96vhTwJRsrD0Ht51MBqmCO4rzV9lkHqcp7vDJQQJ99CBACYeBjFXJ3w3AAAYACOG0Z0v" -o none && echo "✓ lysnr-azure-speech-key"
+
+# 8. Azure OpenAI
+az keyvault secret set --vault-name "$VAULT" --name lysnr-azure-openai-key --value "C15AdlJ4FujhfCGNaZyt9qOC0F3cRjrXuIYtvDX04CWif6fmQdqWJQQJ99CBACfhMk5XJ3w3AAABACOGBKgJ" -o none && echo "✓ lysnr-azure-openai-key"
+az keyvault secret set --vault-name "$VAULT" --name lysnr-azure-openai-endpoint --value "https://swedencentral.api.cognitive.microsoft.com/" -o none && echo "✓ lysnr-azure-openai-endpoint"
+
+echo ""
+echo "=== Done: 12/13 secrets seeded ==="
+echo ""
+echo "⚠️  MANUAL ACTION REQUIRED:"
+echo "   Get from: https://aistudio.google.com/apikey"
+echo ""
+echo "🗑️  DELETE THIS FILE NOW: rm kv.txt"
+
+# 9. Gemini API Key (provided manually)
+az keyvault secret set --vault-name "$VAULT" --name lysnr-gemini-api-key --value "AIzaSyCyx2Eehv1UfSgoZIh0GqU-pnQr9vSxISs" -o none && echo "✓ lysnr-gemini-api-key"