diff --git a/registry/muninn-bsky-card/index.html b/registry/muninn-bsky-card/index.html
index dd798f2..67ec19d 100644
--- a/registry/muninn-bsky-card/index.html
+++ b/registry/muninn-bsky-card/index.html
@@ -608,6 +608,39 @@ <h2>
         </li>
       </ul>
     </section>
+    <section class="panel">
+      <h2>
+        <svg class="glyph" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="1.7" stroke-linecap="round" stroke-linejoin="round" aria-hidden="true">
+          <rect x="4" y="6" width="16" height="12" rx="2"/>
+          <line x1="8" y1="10" x2="16" y2="10"/>
+          <line x1="8" y1="14" x2="13" y2="14"/>
+        </svg>
+        Environment
+      </h2>
+      <table class="kv">
+        <tr>
+          <th><code>BSKY_HANDLE</code></th>
+          <td>
+            <p>The Bluesky handle the CLI authenticates as, e.g. &#x27;austegard.com&#x27;. Required by the `python -m muninn_utils.bsky_card` entrypoint (whoami / post-link / delete-post). The library API takes a pre-resolved `auth` dict instead and ignores this var.</p>
+            <p class="small muted">required &middot; secret: no &middot; <a href="https://bsky.app/settings/account" rel="noopener noreferrer" target="_blank">obtain</a></p>
+          </td>
+        </tr>
+        <tr>
+          <th><code>BSKY_APP_PASSWORD</code></th>
+          <td>
+            <p>App password for BSKY_HANDLE. Format is four hyphen-separated four-character groups. Treat as a secret. Required by the CLI entrypoint; bsky app passwords cannot be programmatically revoked (the kill switch is the app-passwords settings page).</p>
+            <p class="small muted">required &middot; secret: yes &middot; <a href="https://bsky.app/settings/app-passwords" rel="noopener noreferrer" target="_blank">obtain</a></p>
+          </td>
+        </tr>
+        <tr>
+          <th><code>BSKY_PDS</code></th>
+          <td>
+            <p>Optional PDS base URL override. Defaults to https://bsky.social. Set only when authenticating against a self-hosted or non-default PDS.</p>
+            <p class="small muted">optional &middot; secret: no &middot; <a href="https://atproto.com/guides/self-hosting" rel="noopener noreferrer" target="_blank">obtain</a></p>
+          </td>
+        </tr>
+      </table>
+    </section>
     <section class="panel">
       <h2>
         <svg class="glyph" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="1.7" stroke-linecap="round" stroke-linejoin="round" aria-hidden="true">
@@ -634,10 +667,10 @@ <h2>
         Runtime
       </h2>
       <p class="small muted">runtime: <code>python-module</code> &middot; install method: <code>preinstalled</code> &middot; entrypoint: <code>python -m muninn_utils.bsky_card</code></p>
-      <p>Library that an orchestrating agent calls to share a URL on Bluesky with a proper link card. Workflow: fetch the target URL, extract Open Graph tags, upload the card thumbnail as a blob to the user&#x27;s PDS, compose UTF-8 facets for any inline links, and create the post via com.atproto.repo.createRecord. Auth is a Bluesky app password (created at bsky.app/settings/app-passwords); the password grants write access to everything except DMs and account deletion. The tool itself stores nothing; ephemeral session JWTs live only in the calling process&#x27;s memory. First in the consumer-test series for install-manifest-spec v0.3 — see the muninns-inbox discussion #1 thread for the findings the writeup surfaced. Manifest moved here (from muninns-inbox/manifests/) per issue #5 — the round-1 venue mistake. Auth is supplied by the caller as an `auth` dict (`handle`, `did`, `access_jwt`); this utility reads no BSKY_* env vars directly.</p>
+      <p>Library that an orchestrating agent calls to share a URL on Bluesky with a proper link card. Workflow: fetch the target URL, extract Open Graph tags, upload the card thumbnail as a blob to the user&#x27;s PDS, compose UTF-8 facets for any inline links, and create the post via com.atproto.repo.createRecord. Auth is a Bluesky app password (created at bsky.app/settings/app-passwords); the password grants write access to everything except DMs and account deletion. The tool itself stores nothing; ephemeral session JWTs live only in the calling process&#x27;s memory. First in the consumer-test series for install-manifest-spec v0.3 — see the muninns-inbox discussion #1 thread for the findings the writeup surfaced. Manifest moved here (from muninns-inbox/manifests/) per issue #5 — the round-1 venue mistake. Two entry shapes: the library API takes a pre-resolved `auth` dict (`handle`, `did`, `access_jwt`) from the caller, while the `python -m muninn_utils.bsky_card` CLI entrypoint resolves a session from BSKY_HANDLE + BSKY_APP_PASSWORD (see env).</p>
       <p class="small muted">Tags: <span class="badge cap">bluesky</span><span class="badge cap">atproto</span><span class="badge cap">social</span><span class="badge cap">posting</span><span class="badge cap">link-card</span></p>
       <p class="small muted">License: MIT</p>
-      <p><span class="freshness">Last fetched 2026-06-18T09:09:16Z (live)</span></p>
+      <p><span class="freshness">Last fetched 2026-07-09T17:33:29Z (live)</span></p>
     </section>
 
     <footer>