diff --git a/agents/image-maker.md b/agents/image-maker.md
index aea6758..b77eff2 100644
--- a/agents/image-maker.md
+++ b/agents/image-maker.md
@@ -68,13 +68,22 @@ The image comes back as base64 in `choices[0].message.images[0].image_url.url`.
 
 ## API Key
 
-`OPENROUTER_API_KEY` lives in **`/home/sam/.secrets`** (a plain `KEY=value` file). Load it with:
+`OPENROUTER_API_KEY` must be present as an **environment variable**. Do not assume a fixed file path — the canonical location differs per machine.
+
+**Canonical source on all machines:** `~/.config/environment.d/10-secrets.conf` (plain `KEY=value`, no `export`). This is the only location that **systemd user services read**, which is what matters when this subagent runs under Paperclip rather than in an interactive shell.
+
+Check availability first:
 
 ```bash
-set -a; . /home/sam/.secrets; set +a
 echo "${OPENROUTER_API_KEY:+key loaded}"
 ```
 
-It is NOT in `~/.config/environment.d/10-secrets.conf` — older versions of this file claimed that and the call failed.
+If it is empty, source it for the current shell:
+
+```bash
+set -a; . ~/.config/environment.d/10-secrets.conf; set +a
+```
+
+**Do not hardcode other paths.** `.13` additionally keeps keys in `~/.secrets` (an `export`-style file), but `.27` has no `~/.secrets` at all — anything that sources that path fails there. Prefer the environment variable; fall back to `~/.secrets` only if the variable is unset *and* the file exists.
 
 Write detailed, specific prompts. Save images to the user's current working directory or a specified path. Tell the user where you saved the file.