diff --git a/manifests/hub.yaml b/manifests/hub.yaml
index 5a81acc..3641d34 100644
--- a/manifests/hub.yaml
+++ b/manifests/hub.yaml
@@ -171,16 +171,26 @@ spec:
                   name: wg-endpoint-ssh
                   key: hostkey
                   optional: true
+            # Offsite provisioning (SLICE 1+2): Hetzner Storage Box API token + the NUMERIC id of the
+            # pool box, from the out-of-band Secret/storagebox (NOT committed). The token MUST be scoped
+            # to the dedicated storage project — NEVER the shared-project token (it can touch ep0).
+            # HETZNER_POOL_BOX_ID is the numeric box id (console #id), not the box name. Optional so the
+            # pod starts before the secret exists (hub then logs offsite provisioning disabled).
             - name: HETZNER_POOL_BOX_ID
               valueFrom:
                 secretKeyRef:
                   name: storagebox
                   key: HETZNER_POOL_BOX_ID
+                  optional: true
             - name: HETZNER_TOKEN
               valueFrom:
                 secretKeyRef:
                   name: storagebox
                   key: HETZNER_TOKEN
+                  optional: true
+            # Non-secret; the hub defaults to fsn1 anyway — explicit for clarity.
+            - name: HETZNER_LOCATION
+              value: "fsn1"
           resources:
             requests:
               memory: "64Mi"