diff --git a/AGENTS.md b/AGENTS.md
index bd9de7f..80e9546 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -56,6 +56,11 @@ what we take vs. skip). Never vendor it into the build.
   so it matches fine. A curl replay needs `X-Gitea-Event: push` and the
   signature header, or it answers "No matching application or invalid
   signature."
+  The app's `manual_webhook_secret_gitea` is **regenerated whenever the app
+  is recreated** — if the Coolify app is ever recreated, update the Gitea
+  hook's secret too (`PATCH /repos/TZGyn/tunnel/hooks/5` with
+  `{"config":{"secret":"<current>"}}`), or real deliveries silently fail
+  signature checks while curl replays still work.
   This Coolify version stores `custom_labels` **base64-encoded** and does
   *not* merge its generated Traefik labels for API-created apps: the full
   label set must live in `custom_labels` (mirror a working app's generated