diff --git a/playbook.yml b/playbook.yml
index fe0a3de..49085c3 100644
--- a/playbook.yml
+++ b/playbook.yml
@@ -1,8 +1,15 @@
 ---
 - name: Deploy PDS
   hosts: pds
+  become: yes
   vars_files:
     - vars/main.yml
+  vars:
+    pds_data_dir: /pds
+    pds_image_tag: "0.4"
+    pds_blob_upload_limit: 104857600
+    pds_rate_limits_enabled: true
+    pds_invite_required: true
 
   tasks:
     - name: Run PDS installer (first time only)
@@ -12,6 +19,25 @@
         {{ pds_data_dir }} {{ pds_hostname }} {{ pds_admin_email }}
       args:
         creates: "{{ pds_data_dir }}/account.sqlite"
+        executable: /bin/bash
+
+    - name: Read existing secrets from pds.env
+      shell: grep -E '^(PDS_JWT_SECRET|PDS_ADMIN_PASSWORD|PDS_PLC_ROTATION_KEY_K256_PRIVATE_KEY_HEX)=' {{ pds_data_dir }}/pds.env
+      register: existing_secrets
+      changed_when: false
+
+    - name: Set secret facts
+      set_fact:
+        pds_jwt_secret: "{{ existing_secrets.stdout_lines | select('match', '^PDS_JWT_SECRET=') | first | regex_replace('^PDS_JWT_SECRET=', '') }}"
+        pds_admin_password: "{{ existing_secrets.stdout_lines | select('match', '^PDS_ADMIN_PASSWORD=') | first | regex_replace('^PDS_ADMIN_PASSWORD=', '') }}"
+        pds_plc_rotation_key: "{{ existing_secrets.stdout_lines | select('match', '^PDS_PLC_ROTATION_KEY_K256_PRIVATE_KEY_HEX=') | first | regex_replace('^PDS_PLC_ROTATION_KEY_K256_PRIVATE_KEY_HEX=', '') }}"
+
+    - name: Deploy pds.env
+      template:
+        src: templates/pds.env.j2
+        dest: "{{ pds_data_dir }}/pds.env"
+        mode: "0600"
+      notify: apply changes
 
     - name: Deploy compose.yaml
       template:
diff --git a/templates/pds.env.j2 b/templates/pds.env.j2
new file mode 100644
index 0000000..a462a1f
--- /dev/null
+++ b/templates/pds.env.j2
@@ -0,0 +1,35 @@
+PDS_HOSTNAME={{ pds_hostname }}
+PDS_JWT_SECRET={{ pds_jwt_secret }}
+PDS_ADMIN_PASSWORD={{ pds_admin_password }}
+PDS_PLC_ROTATION_KEY_K256_PRIVATE_KEY_HEX={{ pds_plc_rotation_key }}
+PDS_DATA_DIRECTORY={{ pds_data_dir }}
+{% if pds_blobstore_type is defined and pds_blobstore_type == "s3" %}
+PDS_BLOBSTORE_S3_BUCKET={{ pds_blobstore_s3_bucket }}
+PDS_BLOBSTORE_S3_REGION={{ pds_blobstore_s3_region }}
+{% if pds_blobstore_s3_endpoint is defined %}
+PDS_BLOBSTORE_S3_ENDPOINT={{ pds_blobstore_s3_endpoint }}
+{% endif %}
+{% if pds_blobstore_s3_force_path_style is defined %}
+PDS_BLOBSTORE_S3_FORCE_PATH_STYLE={{ pds_blobstore_s3_force_path_style | lower }}
+{% endif %}
+PDS_BLOBSTORE_S3_ACCESS_KEY_ID={{ pds_blobstore_s3_access_key }}
+PDS_BLOBSTORE_S3_SECRET_ACCESS_KEY={{ pds_blobstore_s3_secret_key }}
+{% else %}
+PDS_BLOBSTORE_DISK_LOCATION={{ pds_data_dir }}/blocks
+{% endif %}
+PDS_BLOB_UPLOAD_LIMIT={{ pds_blob_upload_limit }}
+PDS_DID_PLC_URL=https://plc.directory
+PDS_BSKY_APP_VIEW_URL=https://api.bsky.app
+PDS_BSKY_APP_VIEW_DID=did:web:api.bsky.app
+PDS_REPORT_SERVICE_URL=https://mod.bsky.app
+PDS_REPORT_SERVICE_DID=did:plc:ar7c4by46qjdydhdevvrndac
+PDS_CRAWLERS=https://bsky.network
+LOG_ENABLED=true
+PDS_RATE_LIMITS_ENABLED={{ pds_rate_limits_enabled | lower }}
+PDS_INVITE_REQUIRED={{ pds_invite_required | lower }}
+{% if pds_email_smtp_url is defined %}
+PDS_EMAIL_SMTP_URL={{ pds_email_smtp_url }}
+{% endif %}
+{% if pds_email_from_address is defined %}
+PDS_EMAIL_FROM_ADDRESS={{ pds_email_from_address }}
+{% endif %}
diff --git a/vars/main.yml.example b/vars/main.yml.example
index 2d31663..5c2e363 100644
--- a/vars/main.yml.example
+++ b/vars/main.yml.example
@@ -6,3 +6,19 @@ pds_admin_email: admin@example.com
 # pds_data_dir must be /pds — the installer enforces this
 pds_data_dir: /pds
 pds_image_tag: "0.4"
+pds_blob_upload_limit: 104857600
+pds_rate_limits_enabled: true
+pds_invite_required: true
+
+# S3 blob storage (uncomment to use instead of disk)
+# pds_blobstore_type: s3
+# pds_blobstore_s3_bucket: my-pds-blobs
+# pds_blobstore_s3_region: us-east-1
+# pds_blobstore_s3_endpoint: https://s3.example.com  # omit for AWS S3
+# pds_blobstore_s3_force_path_style: true
+# pds_blobstore_s3_access_key: CHANGE_ME
+# pds_blobstore_s3_secret_key: CHANGE_ME
+
+# Email (uncomment to enable email verification)
+# pds_email_smtp_url: smtps://username:password@smtp.example.com/
+# pds_email_from_address: admin@example.com