diff --git a/plex/.env.example b/plex/.env.example
new file mode 100644
index 0000000..98e9385
--- /dev/null
+++ b/plex/.env.example
@@ -0,0 +1,19 @@
+# /srv/plex/.env — copy to .env on the media box, fill in, chmod 600.
+# Real values never get committed. docker compose reads this automatically
+# from the project directory.
+
+# Watchtower's update report, published to the ntfy `arrsstack-alerts` topic.
+# Shoutrrr format: ntfy://<user>:<password>@<host>/<topic>
+#
+# The credential is the dedicated ntfy user `watchtower`, write-only on
+# arrsstack-alerts and nothing else — NOT the admin account and NOT the older
+# `publisher` user that owns the scouting topics. Created 2026-08-03 when ntfy
+# moved to auth-default-access deny-all; until then this URL carried no
+# credentials at all and published anonymously.
+#
+# Verified at setup: 200 to arrsstack-alerts, 403 to any other topic.
+WATCHTOWER_NOTIFICATION_URL=ntfy://watchtower:FILL_ME@ntfy.thewichersfamily.com/arrsstack-alerts
+
+# Optional. Both have working defaults in docker-compose.yml.
+# TZ=America/New_York
+# RENDER_GID=993