diff --git a/.vitepress/data/commands.yaml b/.vitepress/data/commands.yaml
index a18f14f..30836e4 100644
--- a/.vitepress/data/commands.yaml
+++ b/.vitepress/data/commands.yaml
@@ -330,6 +330,11 @@ commands:
                 - name: length
                   default: "32"
                   usage: Key length in bytes
+        - name: ws-cli secrets materialize
+          since: next
+          synopsis: Project the configured master key to its conventional secret path
+          description: Persist WS_SECRETS_MASTER_KEY to /run/secrets/workspace/secrets/master_key so the key outlives the editor's environment scrub. A no-op when the key is unset or the path already holds one.
+          usage: ws-cli secrets materialize
     - name: ws-cli seed
       since: next
       synopsis: Project declarative content onto the filesystem
diff --git a/.vitepress/data/fonts.yaml b/.vitepress/data/fonts.yaml
index 7c98f5a..2ac8749 100644
--- a/.vitepress/data/fonts.yaml
+++ b/.vitepress/data/fonts.yaml
@@ -1,17 +1,21 @@
 ---
 ################################ Fonts Manifest ###############################
 #
-# Fonts (and theme) bundled with the image. Distributed via ws-meta to ws-docs.
+# Web fonts served with the editor. Fetched at build time by `scripts/fonts.sh`
+# and baked (web copies only) into the served tree at `server/browser/fonts/`
+# (served by the H3 `/__ws__/fonts` route). This is the ws-meta distribution
+# origin for the manifest: ws-docs sources its licenses table from here.
 #
 #   name/license/home  shown in the docs licenses table
-#   install:           OPTIONAL. Present => downloaded at build time (rendered
-#                      to fonts.sh via fonts.sh.j2). Absent => attribution-only.
-#     datasource/package/version  Renovate metadata
-#     url       `${repo}` (= package) and `${version}` are shell vars
-#     archive   tar.gz (extracted whole) | zip
-#     extract   in-archive paths copied into /fonts/<key> (zip only)
+#   install:           OPTIONAL. Present => downloaded at build time.
+#                      Absent => attribution-only (theme / UI font, no web copy).
+#     datasource/package/version  Renovate metadata (renovate.json jsonata manager)
 #
-# Files land in /fonts/<key>. Sorted by key, case-insensitive.
+# The download URL and the per-archive layout live in `scripts/fonts.sh`, which reads
+# `version:` from here and nothing else. Declaring them twice meant one of the two was
+# always a lie.
+#
+# Sorted by key, case-insensitive.
 ################################################################################
 fonts:
   catppuccin:
@@ -32,12 +36,6 @@ fonts:
       datasource: github-releases
       package: tonsky/FiraCode
       version: "6.2"
-      url: https://github.com/${repo}/releases/download/${version}/Fira_Code_v${version}.zip
-      archive: zip
-      extract:
-        - ttf
-        - woff
-        - woff2
 
   meslo:
     name: MesloLGS
@@ -47,8 +45,6 @@ fonts:
       datasource: github-releases
       package: romkatv/powerlevel10k-media
       version: 2.3.3
-      url: https://github.com/${repo}/releases/download/v${version}/meslo-lgs-nf.tar.gz
-      archive: tar.gz
 
   victormono:
     name: Victor Mono
@@ -58,8 +54,3 @@ fonts:
       datasource: github-releases
       package: rubjo/victor-mono
       version: 1.5.6
-      url: https://github.com/${repo}/archive/refs/tags/v${version}.zip
-      archive: zip
-      extract:
-        - victor-mono-${version}/dist/woff
-        - victor-mono-${version}/dist/woff2