diff --git a/AMPLIFY_DEPLOY.md b/AMPLIFY_DEPLOY.md
index db2f48c..7e22b95 100644
--- a/AMPLIFY_DEPLOY.md
+++ b/AMPLIFY_DEPLOY.md
@@ -32,36 +32,46 @@ through managed Lambda behind a CloudFront CDN. The `amplify.yml` and
 6. Amplify reads `amplify.yml` automatically; you do not need to edit
    the build spec on this screen. Click **Next**.
 
-## Step 2 — Environment variables
+## Step 2 — Environment variables and Secrets
 
-On the environment-variables screen, add the following. Required ones first:
+Amplify Gen 2 splits configuration across **two separate pages** in the
+console sidebar (under **Hosting**):
 
-| Variable | Value |
-|---|---|
-| `CIVI_BASE_URL` | e.g. `https://crm.fci.coop` |
-| `CIVI_API_KEY` | mark as **Secret** (eye icon on the value field) |
-| `CIVI_SITE_KEY` | mark as **Secret** |
+- **Environment variables** — plaintext-at-rest, intended for non-sensitive
+  config. Readable by anyone with `amplify:GetApp` permission on the AWS
+  account.
+- **Secrets** — values stored in AWS Systems Manager Parameter Store as
+  SecureString, encrypted at rest. Injected into the build/runtime as
+  normal environment variables under the same name, so application code
+  doesn't need to know the difference.
 
-Do **not** set `NODE_ENV=production` in the Amplify panel. Amplify and Next
-already set it correctly at runtime; setting it at build time causes
-`npm ci` to skip devDependencies, which breaks the Tailwind/PostCSS step.
-The `amplify.yml` in this repo guards against this with `--include=dev`,
-but it's cleaner not to set it at all.
+Add each variable to the page indicated below:
 
-Optional, only if relevant:
+| Variable | Page | Notes |
+|---|---|---|
+| `CIVI_BASE_URL` | Environment variables | e.g. `https://crm.fci.coop` |
+| `CIVI_API_KEY` | **Secrets** | Required |
+| `CIVI_SITE_KEY` | **Secrets** | Required |
+| `CIVI_HTTP_AUTH_USER` | Environment variables | Only if CiviCRM has webserver-level Basic Auth in front of it |
+| `CIVI_HTTP_AUTH_PASS` | **Secrets** | Only if above set |
+| `HEALTH_TOKEN` | **Secrets** | Optional; gates `/api/health` in production |
+| `PREVIEW_ADMIN_TOKEN` | **Secrets** | Optional; gates `/api/preview-link` |
 
-| Variable | When |
-|---|---|
-| `CIVI_HTTP_AUTH_USER` | CiviCRM has webserver-level Basic Auth in front of it |
-| `CIVI_HTTP_AUTH_PASS` | same — mark **Secret** |
-| `HEALTH_TOKEN` | gates `/api/health` in production — mark **Secret** |
-| `PREVIEW_ADMIN_TOKEN` | gates `/api/preview-link` — mark **Secret** |
+Rule of thumb: if leaking the value would let someone impersonate the app
+to CiviCRM, or bypass a gate, it goes in **Secrets**. Hostnames and
+usernames are fine in plaintext Environment variables.
 
-"Secret" values are encrypted at rest in AWS Systems Manager Parameter
-Store and only injected into the build/runtime environment. They are not
-visible in logs or to anyone without `amplify:*` IAM permissions.
+> **Don't set `NODE_ENV=production` in either page.** Amplify and Next
+> already set it correctly at runtime; setting it at build time causes
+> `npm ci` to skip devDependencies, which breaks the Tailwind/PostCSS
+> step. The `amplify.yml` in this repo guards against this with
+> `--include=dev`, but it's cleaner not to set it at all.
 
-Click **Next**, review, **Save and deploy**.
+> **Don't duplicate names across both pages.** If the same variable
+> name appears in both Environment variables and Secrets, Amplify's
+> precedence is undefined in Gen 2.
+
+Click through, review, **Save and deploy**.
 
 ## Step 3 — First build