diff --git a/.gitea/workflows/server-deploy.yml b/.gitea/workflows/server-deploy.yml
index b640793..cabdd28 100644
--- a/.gitea/workflows/server-deploy.yml
+++ b/.gitea/workflows/server-deploy.yml
@@ -147,6 +147,8 @@ jobs:
                   docker build \
                     --build-arg NEXT_PUBLIC_ADMIN_API_URL="${{ vars.ADMIN_API_URL }}" \
                     --build-arg NEXT_PUBLIC_ADMIN_ENV="${{ vars.ADMIN_ENV }}" \
+                    --build-arg NEXT_PUBLIC_PADDLE_CLIENT_TOKEN="${{ vars.PADDLE_CLIENT_TOKEN }}" \
+                    --build-arg NEXT_PUBLIC_PADDLE_ENV="${{ vars.PADDLE_ENV }}" \
                     -t "$IMAGE" \
                     -f adminsite/Dockerfile adminsite/
                   docker push "$IMAGE"
diff --git a/deploy/docker-compose.site.yml b/deploy/docker-compose.site.yml
index a73b3c1..0cd0772 100644
--- a/deploy/docker-compose.site.yml
+++ b/deploy/docker-compose.site.yml
@@ -57,6 +57,13 @@ services:
             SMTP_FROM: ${SMTP_FROM:-}
             APP_LOGIN_URL: ${APP_LOGIN_URL:-}
             FREE_INSTANCE_REAP_AFTER: "336h"
+            # Paddle billing. PADDLE_API_KEY and PADDLE_WEBHOOK_SECRET are
+            # boot-REQUIRED — an unverified webhook endpoint is one anyone can
+            # issue licences through. PADDLE_ENV selects which catalogue price
+            # IDs are served (sandbox|production).
+            PADDLE_ENV: ${PADDLE_ENV:-sandbox}
+            PADDLE_API_KEY: ${PADDLE_API_KEY:-}
+            PADDLE_WEBHOOK_SECRET: ${PADDLE_WEBHOOK_SECRET:-}
 
     # The staff and customer console, served at vantage-hq.hostxtra.co.uk.
     # ADMIN_API_URL is baked into the image at build time, not read here, so
diff --git a/docs/superpowers/specs/README.md b/docs/superpowers/specs/README.md
index 97b0fd4..f976bb7 100644
--- a/docs/superpowers/specs/README.md
+++ b/docs/superpowers/specs/README.md
@@ -10,7 +10,7 @@ Build in this order. Specs 0a–5 were designed 2026-07-24; spec 6 on 2026-07-26
 | 2 | [instance-licensing](2026-07-24-instance-licensing-design.md) | [plan](../plans/2026-07-24-instance-licensing.md) | **shipped**, no grandfathering — existing cloud instances are read-only until admin backfills |
 | 3 | [admin-backend](2026-07-24-admin-backend-design.md) | [plan](../plans/2026-07-24-admin-backend.md) | **shipped**, verified end to end against scratch databases |
 | 4 | [admin-site](2026-07-24-admin-site-design.md) | — | ready to start |
-| 5 | [paddle-billing](2026-07-24-paddle-billing-design.md) | [plan](../plans/2026-07-26-paddle-billing.md) | ready to start, **but revised by 7** — its "signup migration off sitesvc" section is superseded by 6, and its single-price-per-subscription assumption by 7 |
+| 5 | [paddle-billing](2026-07-24-paddle-billing-design.md) | [plan](../plans/2026-07-27-paddle-billing.md) | **shipped (code)** — client, webhooks, checkout, entitlement update and portal built and compiled against spec-7's catalogue/entitlements; signup-migration dropped (done by 6). Live sandbox catalog + end-to-end pass is the operator's step. Old [2026-07-26 plan](../plans/2026-07-26-paddle-billing.md) superseded. |
 | 6 | [cloud-instance-creation](2026-07-26-cloud-instance-creation-design.md) | — | ready to start |
 | 7 | [metered-licensing](2026-07-26-metered-licensing-design.md) | [plan](../plans/2026-07-26-metered-licensing.md) | **shipped** — staff can configure and issue any of the six plans; no customer can buy one until 5 lands |