diff --git a/.gitignore b/.gitignore
index d998e0d..b03c34e 100644
--- a/.gitignore
+++ b/.gitignore
@@ -30,3 +30,6 @@ Thumbs.db
 
 # Tool caches
 .impeccable/
+
+# Pi provisioning (real device secret) — never commit
+deploy/device.env
diff --git a/deploy/setup_online.sh b/deploy/setup_online.sh
index 905806a..6b42893 100755
--- a/deploy/setup_online.sh
+++ b/deploy/setup_online.sh
@@ -5,7 +5,12 @@
 # Run from a clone/copy of this repo, as root:
 #   sudo deploy/setup_online.sh
 #
-# Non-interactive: pass values as env vars, e.g.
+# Pre-provisioned (shortest path): put the values in deploy/device.env on the BUILD machine
+# (DEVICE_ID / DEVICE_SECRET / CAFE24_URL / CAMERAS, one KEY=value per line, gitignored), copy
+# the repo to the Pi, and the whole install is just:
+#   sudo deploy/setup_online.sh
+#
+# Non-interactive: pass values as env vars (these override device.env), e.g.
 #   sudo DEVICE_ID=pi-01 DEVICE_SECRET=... CAFE24_URL=https://server CAMERAS=csi:0:cam-01,uvc:0:cam-02 \
 #        HAILO_HEF=/home/pi/yolov8s_pose.hef deploy/setup_online.sh
 # The Hailo HEF is normally auto-fetched for the detected board; you do not need HAILO_HEF.
@@ -230,6 +235,17 @@ if [ -f "$ETC/edge.env" ]; then
     echo "   -> $ETC/edge.env: POSE_BACKEND ${cur:-<unset>} -> $POSE_BACKEND (re-run reconciled)"
   fi
 else
+  # Pre-provisioning file: values written on the BUILD machine so the operator only has to
+  # type `sudo deploy/setup_online.sh`. A real env var always wins over the file, so the
+  # long-form command documented at the top still overrides a stale device.env.
+  PROVISION="${PROVISION:-$REPO_ROOT/deploy/device.env}"
+  if [ -f "$PROVISION" ]; then
+    echo ">> reading pre-provisioned values from $PROVISION"
+    while IFS='=' read -r k v; do
+      case "$k" in DEVICE_ID|DEVICE_SECRET|CAFE24_URL|CAMERAS) ;; *) continue ;; esac
+      [ -n "${!k:-}" ] || printf -v "$k" '%s' "$v"
+    done < <(grep -E '^[A-Z_][A-Z0-9_]*=' "$PROVISION")   # digits matter: CAFE24_URL
+  fi
   : "${DEVICE_ID:=}"; : "${DEVICE_SECRET:=}"; : "${CAFE24_URL:=}"; : "${CAMERAS:=}"
   if [ -t 0 ]; then
     [ -n "$DEVICE_ID" ]     || read -rp  "DEVICE_ID [pi-01]: " DEVICE_ID