diff --git a/INTEGRATION.md b/INTEGRATION.md
index 5ccd0ee..e7b5dda 100644
--- a/INTEGRATION.md
+++ b/INTEGRATION.md
@@ -31,6 +31,13 @@ A deploy identity should almost always be granted **read-only** access
 needs to `pull`, and a read-only grant means a compromised deploy box
 can't also rotate the vault or add itself more recipients.
 
+When you do the first `keep push` for a project, push the *real*,
+hand-maintained `.env` rather than a stripped-down one — any `# get this
+from X` / `# rotate quarterly` comments in it get preserved (values
+redacted) as a template alongside the secrets, retrievable later with
+`keep pull <vault> --template`. That's the one moment this context is
+available at all; a `.env` reconstructed later from memory won't have it.
+
 ## Getting the `keep` CLI onto a machine
 
 Chicken-and-egg: every pattern below assumes `keep` is already a runnable