diff --git a/CHANGELOG.md b/CHANGELOG.md
index a8e5453..2cf9479 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,5 +1,14 @@
 ## Changelog
 
+### docs — controller.yaml.example: hub api_key literal scrubbed (2026-07-13)
+
+The example carried the REAL hub global bearer key (the `manifests/hub.yaml` committed literal,
+rotation-flagged in two publish runbooks). Replaced with a placeholder — real deployments get a
+hub-issued per-customer key baked by configgen; the example was never a live consumer. Part of
+the hub v0.53.0 bearer de-git (felhom.eu); the value itself dies with the supervised rotation
+(documentation/runbooks/secrets.md §"Operator/global bearer key" in felhom.eu). No code change,
+no version bump.
+
 ### v0.126.4 — edge-safe error statuses + the native-alert ban (2026-07-13)
 
 Two defects surfaced by the agent-0.87.0 wizard leg's decommission attempt (the M1 refusal —
diff --git a/controller/configs/controller.yaml.example b/controller/configs/controller.yaml.example
index e808c83..4a108d7 100644
--- a/controller/configs/controller.yaml.example
+++ b/controller/configs/controller.yaml.example
@@ -95,7 +95,7 @@ monitoring:
 hub:
   enabled: true                                      # Enable central reporting
   url: "https://hub.felhom.eu"                       # Hub API endpoint
-  api_key: "094091de545ce28795c47ac2158fc30750db5c24a621c49329b001ee8db57fb8"  # Shared secret for authentication
+  api_key: "<hub-issued-per-customer-key>"           # From the hub-generated config; never commit a real key
   push_interval: "15m"                               # How often to push reports
 
 # --- Self-update ---