diff --git a/Dockerfile b/example/Dockerfile
similarity index 100%
rename from Dockerfile
rename to example/Dockerfile
diff --git a/docker-compose.yml b/example/docker-compose.yml
similarity index 100%
rename from docker-compose.yml
rename to example/docker-compose.yml
diff --git a/entrypoint.sh.example b/example/entrypoint.sh.example
similarity index 84%
rename from entrypoint.sh.example
rename to example/entrypoint.sh.example
index f29fc3e..a80704d 100644
--- a/entrypoint.sh.example
+++ b/example/entrypoint.sh.example
@@ -47,7 +47,12 @@ fi
 if [ -f "/code/Gemfile" ]; then
   echo "Gemfile found — running bundle install..."
   pushd /code
-  BUNDLE_GEMS__GRAPHQL__PRO="gql_2e0_d66f5103067:70c113ba329" bundle install
+  # TODO: Elaborate or expand — wire secrets (e.g. a private gem registry token)
+  # in from the environment instead of hardcoding. Compose's auto-loaded .env only
+  # does YAML interpolation (next to the compose file), not container injection;
+  # injecting needs `environment:`/`env_file:`. In the project-local model, point
+  # this at the mounted project's .safeclaude/.env so secrets live with the project.
+  BUNDLE_GEMS__GRAPHQL__PRO="${BUNDLE_GEMS__GRAPHQL__PRO:-}" bundle install
   popd
 fi
 
diff --git a/safeclaude b/example/safeclaude
similarity index 100%
rename from safeclaude
rename to example/safeclaude