diff --git a/.ebextensions/02_webhook_config.config b/.ebextensions/02_webhook_config.config
new file mode 100644
index 0000000..59cc87d
--- /dev/null
+++ b/.ebextensions/02_webhook_config.config
@@ -0,0 +1,8 @@
+# Sets the non-secret pointer the work-order webhook receiver reads to locate
+# the producer HMAC keyset; the keyset itself is fetched at runtime through
+# the instance role's cross-account grant. Do not set this property directly
+# with update-environment: directly set values take precedence over
+# .ebextensions and would silently turn this file into dead text.
+option_settings:
+  aws:elasticbeanstalk:application:environment:
+    WorkOrderWebhook__SecretId: arn:aws:secretsmanager:us-east-1:011934824531:secret:workorder-ingest/shoc-webhook-hmac-puYTcB
\ No newline at end of file