diff --git a/.env.example b/.env.example
index e094eff..21d12e9 100644
--- a/.env.example
+++ b/.env.example
@@ -8,3 +8,9 @@ POSTGRES_USER=device_cloud
 POSTGRES_PASSWORD=change-me-database-password
 
 CLOUD_API_PORT=8001
+
+# Fernet key protecting database-managed LLM Provider API keys. Generate once
+# and preserve it with the database backups (rotating it makes stored keys
+# undecryptable):
+#   python -c "from cryptography.fernet import Fernet; print(Fernet.generate_key().decode())"
+CLOUD_LLM_PROVIDER_ENCRYPTION_KEY=change-me-generate-a-fernet-key
diff --git a/compose.deploy.yaml b/compose.deploy.yaml
index 914f7ce..1ffce31 100644
--- a/compose.deploy.yaml
+++ b/compose.deploy.yaml
@@ -26,6 +26,7 @@ services:
       CLOUD_ENVIRONMENT: production
       CLOUD_DATABASE_URL: postgresql+psycopg://${POSTGRES_USER}:${POSTGRES_PASSWORD}@postgres:5432/${POSTGRES_DB}
       CLOUD_TRUST_PROXY_HEADERS: ${CLOUD_TRUST_PROXY_HEADERS:-false}
+      CLOUD_LLM_PROVIDER_ENCRYPTION_KEY: ${CLOUD_LLM_PROVIDER_ENCRYPTION_KEY}
     ports:
       - "${CLOUD_API_PORT:-8001}:8001"
     depends_on:
diff --git a/compose.yaml b/compose.yaml
index a351e27..d4e3316 100644
--- a/compose.yaml
+++ b/compose.yaml
@@ -27,6 +27,7 @@ services:
       CLOUD_ENVIRONMENT: production
       CLOUD_DATABASE_URL: postgresql+psycopg://${POSTGRES_USER}:${POSTGRES_PASSWORD}@postgres:5432/${POSTGRES_DB}
       CLOUD_TRUST_PROXY_HEADERS: ${CLOUD_TRUST_PROXY_HEADERS:-false}
+      CLOUD_LLM_PROVIDER_ENCRYPTION_KEY: ${CLOUD_LLM_PROVIDER_ENCRYPTION_KEY}
     ports:
       - "${CLOUD_API_PORT:-8001}:8001"
     depends_on: