diff --git a/apps/mobile/README.md b/apps/mobile/README.md
index 8202016..abd480b 100644
--- a/apps/mobile/README.md
+++ b/apps/mobile/README.md
@@ -73,6 +73,23 @@ Copy `.env.example` to `.env.local` and fill in the same Supabase host +
 anon key the desktop uses. Expo bundles only `EXPO_PUBLIC_*`-prefixed
 vars into the JS, which is what the three required values use.
 
+## EAS Builds and Environment Variables
+
+Production and preview builds load `EXPO_PUBLIC_*` from EAS Secrets —
+`.env.local` is only honoured by `expo start` locally. Without the
+secrets configured, an APK installs but `env.ts` throws on first read
+and `<BootError>` renders.
+
+Required secrets (create once per project):
+
+```bash
+npx eas-cli secret:create --scope project --name EXPO_PUBLIC_SUPABASE_URL --value '<project-supabase-url>'
+npx eas-cli secret:create --scope project --name EXPO_PUBLIC_SUPABASE_ANON_KEY --value '<sb_publishable_key>'
+npx eas-cli secret:create --scope project --name EXPO_PUBLIC_AUTH_REDIRECT_URL --value 'netralax://auth/callback'
+```
+
+Check with `npx eas-cli secret:list`.
+
 ## Roadmap
 
 See `docs/superpowers/specs/2026-05-13-mobile-deployment-roadmap.md`.