diff --git a/dot_config/mise/config.toml.tmpl b/dot_config/mise/config.toml.tmpl
index febae85..ea3b57e 100644
--- a/dot_config/mise/config.toml.tmpl
+++ b/dot_config/mise/config.toml.tmpl
@@ -37,6 +37,7 @@ rust   = "stable"
 "aqua:sharkdp/fd"                           = "latest"
 "aqua:gitleaks/gitleaks"                    = "latest"
 "aqua:mikefarah/yq"                         = "latest"   # Go yq, NOT Python
+"aqua:direnv/direnv"                         = "latest"   # per-project env+secrets (see hook in dot_zshrc)
 
 # --- Cloud + Kubernetes -------------------------------------------------
 "aqua:helm/helm"                            = "latest"
@@ -84,7 +85,8 @@ op                                          = "latest"
 # Not in mise (installed elsewhere):
 #   htop/tree/nmap/wireguard-tools/telnet/postgresql-client — OS-native (C deps)
 #
-# direnv intentionally NOT used — mise officially discourages running both
-# (PATH conflicts, "not bugs"). mise's [env] + `_.file = '.env'` in a project
-# mise.toml replaces .envrc, auto-applied on cd via `mise activate`.
+# Division of labour with direnv (hooked in dot_zshrc): mise owns TOOL VERSIONS,
+# direnv owns per-project ENV + 1Password secrets (.envrc + from_op). Safe to
+# run both — mise only conflicts with direnv when BOTH manage a tool (e.g.
+# `layout python` vs python here). Never use direnv `layout`/PATH_add for tools.
 {{- end }}
diff --git a/dot_p10k.zsh b/dot_p10k.zsh
index 1004f79..0e2991c 100644
--- a/dot_p10k.zsh
+++ b/dot_p10k.zsh
@@ -1700,7 +1700,10 @@
   #   - verbose: Enable instant prompt and print a warning when detecting console output during
   #              zsh initialization. Choose this if you've never tried instant prompt, haven't
   #              seen the warning, or if you are unsure what this all means.
-  typeset -g POWERLEVEL9K_INSTANT_PROMPT=verbose
+  # 'quiet' not 'verbose': direnv prints "direnv: loading …/.envrc" on shell
+  # start inside an .envrc dir (common with tmux panes / SSH into a project) —
+  # 'verbose' flags that benign output as an instant-prompt warning every time.
+  typeset -g POWERLEVEL9K_INSTANT_PROMPT=quiet
 
   # Terminal shell integration. Emits OSC 133 semantic marks (prompt-start,
   # input-start, command/output-start, output-end + exit code) so terminals
diff --git a/dot_zshrc b/dot_zshrc
index 7ba719b..54e4a66 100644
--- a/dot_zshrc
+++ b/dot_zshrc
@@ -182,3 +182,10 @@ fi
 # Override the p10k prompt itself via `p10k configure` editing
 # `~/.p10k.zsh` directly (Powerlevel10k convention).
 [[ ! -f ~/.zshrc_local ]] || source ~/.zshrc_local
+
+# --- direnv (per-project env + 1Password secrets via .envrc) ---
+# Division of labour: mise owns tool versions, direnv owns per-project env +
+# secrets (e.g. `from_op` op:// refs in an .envrc). Safe alongside mise as long
+# as direnv never manages tools/PATH (no `layout`/`PATH_add` for toolchains).
+# Hook goes LAST (after prompt + ~/.zshrc_local) per direnv's own guidance.
+command -v direnv > /dev/null && eval "$(direnv hook zsh)"