diff --git a/.gitignore b/.gitignore
index 09c76a24b..b041e596b 100644
--- a/.gitignore
+++ b/.gitignore
@@ -21,3 +21,6 @@ tmp/
 *.tfstate.*
 crash.log
 terraform/atlas/generated/
+
+# Local demo credentials (never commit)
+scripts/ops/hermes_triage_demo.env
diff --git a/scripts/ops/hermes_triage_demo.env.example b/scripts/ops/hermes_triage_demo.env.example
new file mode 100644
index 000000000..e03be508c
--- /dev/null
+++ b/scripts/ops/hermes_triage_demo.env.example
@@ -0,0 +1,15 @@
+# Copy to hermes_triage_demo.env (same directory) and fill in.
+# That filename is git-ignored so it can hold real tokens.
+
+# Jenkins API token: https://ci.bstein.dev -> your user -> Configure -> API Token
+export JENKINS_USER="your-jenkins-user"
+export JENKINS_TOKEN="your-jenkins-api-token"
+
+# Gitea token, used only to report open pull requests during preflight.
+# Preflight still works without it; that one line will read "?".
+export GITEA_TOKEN="your-gitea-token"
+
+# Override only if you are not pointing at the usual lab.
+# export JENKINS_URL="https://ci.bstein.dev"
+# export GITEA_URL="https://scm.bstein.dev"
+# export CODE_REPO_DIR="$HOME/Development/hermes-code-demo"
diff --git a/scripts/ops/hermes_triage_demo.sh b/scripts/ops/hermes_triage_demo.sh
index 6e2afc540..1cbfe14ca 100755
--- a/scripts/ops/hermes_triage_demo.sh
+++ b/scripts/ops/hermes_triage_demo.sh
@@ -6,12 +6,22 @@
 #   hermes_triage_demo.sh status    # current incident/alert state, no changes
 #   hermes_triage_demo.sh preflight # confirm the lab is ready to demo
 #
-# Requires JENKINS_USER and JENKINS_TOKEN in the environment (a Jenkins API
-# token) plus kubectl access to the cluster. Nothing here mutates the cluster
+# FIRST RUN: copy hermes_triage_demo.env.example to hermes_triage_demo.env in
+# this directory and fill it in. That file is git-ignored precisely so it can
+# hold real tokens; this script sources it automatically, so nothing needs to
+# be exported by hand.
+#
+# Needs kubectl access to the cluster as well. Nothing here mutates the cluster
 # directly: the fixture demo only asks Jenkins to run a parameterized build,
 # and the code demo only pushes a seeded defect to the demo repository.
 set -euo pipefail
 
+# Local, git-ignored credentials. Sourced before anything else so every value
+# below can be overridden from it.
+_DEMO_ENV="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)/hermes_triage_demo.env"
+# shellcheck disable=SC1090
+[ -r "$_DEMO_ENV" ] && . "$_DEMO_ENV"
+
 JENKINS_URL="${JENKINS_URL:-https://ci.bstein.dev}"
 FIXTURE_JOB="hermes-triage-demo"
 CODE_JOB="hermes-code-demo"
@@ -22,7 +32,11 @@ say() { printf '\n\033[1m[%s] %s\033[0m\n' "$(date -u +%H:%M:%S)" "$*"; }
 note() { printf '        %s\n' "$*"; }
 
 require_jenkins() {
-  : "${JENKINS_USER:?set JENKINS_USER}" "${JENKINS_TOKEN:?set JENKINS_TOKEN}"
+  if [ -z "${JENKINS_USER:-}" ] || [ -z "${JENKINS_TOKEN:-}" ]; then
+    echo "Missing Jenkins credentials." >&2
+    echo "Create $_DEMO_ENV from hermes_triage_demo.env.example and fill it in." >&2
+    exit 1
+  fi
 }
 
 jenkins_get() { curl -sk -u "$JENKINS_USER:$JENKINS_TOKEN" "$JENKINS_URL$1"; }
@@ -117,11 +131,11 @@ cmd_fixture() {
   note "result: $(wait_for_build "$FIXTURE_JOB" "$next_num")"
 
   say "Ariadne detects, gathers evidence, asks Hermes, authorizes, repairs"
-  local repair="hermes-demo-repair-$next_num"
+  note "the repair is a single in-process ConfigMap patch, so watch the fixture"
   for _ in $(seq 1 40); do
     sleep 10
-    if [ "$(kubectl -n "$DEMO_NS" get job "$repair" -o jsonpath='{.status.succeeded}' 2>/dev/null)" = "1" ]; then
-      note "repair job $repair succeeded"
+    if [ "$(kubectl -n "$DEMO_NS" get cm hermes-triage-demo-fixture -o jsonpath='{.data.state}' 2>/dev/null)" = "healthy" ]; then
+      note "fixture patched back to healthy"
       break
     fi
   done