diff --git a/.claude/memory/MEMORY.md b/.claude/memory/MEMORY.md
index 253e16a..7c53778 100644
--- a/.claude/memory/MEMORY.md
+++ b/.claude/memory/MEMORY.md
@@ -34,6 +34,7 @@
 - [Syncro Emergency Billing](feedback_syncro_emergency_billing.md) — Emergency = 1.5× multiplier, not additive. Branch by `customer.prepay_hours`: no-prepaid → `26184` at actual hrs; prepaid → `26118` at hrs×1.5. Never stack. Always set `price_retail`.
 - [Identity precedence](feedback_identity_precedence.md) — Trust `.claude/identity.json` over the system-reminder `userEmail` hint when they disagree (shared-login machines).
 - [1Password — always use service token](feedback_1password_service_token.md) — Source OP_SERVICE_ACCOUNT_TOKEN from SOPS for every `op` call. Desktop-app integration prompts are unacceptable in agent flows.
+- [Point vault-access teammates at SOPS path](feedback_vault_pointer_for_teammates.md) — When relaying infra/credential info to Howard or other vault-access teammates, hand over the SOPS path + key anchors; don't transcribe the entry's fields into the message.
 - [/tmp path mismatch on Windows](feedback_tmp_path_windows.md) — Write tool and Git Bash resolve `/tmp` to DIFFERENT real dirs. Use heredoc or workspace path for JSON payloads handed to curl. Caused wrong-comment incident on Syncro #32225.
 - [Syncro — leave contact blank by default](feedback_syncro_blank_contact.md) — Default to blank contact ("Not Assigned") on tickets and billing for ALL customers. Blank lets Syncro use company-level email defaults; setting a contact may route to a secondary email and bypass distribution. Generalizes the prior Cascades-only rule per Winter 2026-05-04.
 - [Syncro — Cascades contact incident (Meredith Kuhn)](feedback_syncro_cascades_contact.md) — Meredith Kuhn is the recurring wrong Syncro default at Cascades. Incident context only; global rule is in feedback_syncro_blank_contact.md.
diff --git a/.claude/memory/feedback_vault_pointer_for_teammates.md b/.claude/memory/feedback_vault_pointer_for_teammates.md
new file mode 100644
index 0000000..60b98a5
--- /dev/null
+++ b/.claude/memory/feedback_vault_pointer_for_teammates.md
@@ -0,0 +1,15 @@
+---
+name: Point vault-access teammates at the SOPS path, don't transcribe
+description: When relaying infra/credential info to Howard (or any teammate with vault access), hand over the SOPS vault path and let them decrypt — don't transcribe the entry's fields into the message
+type: feedback
+---
+
+When sending infra, service, or credential details to a teammate via coord messages (or any shared channel), point them at the SOPS vault path (e.g. `services/azure-trusted-signing.sops.yaml`) rather than transcribing the entry's fields into the message body.
+
+**Why:** Mike, 2026-05-26. Howard has full vault access. I composed a GuruScan signing note to Howard that re-typed a dozen non-secret fields from the Trusted Signing vault entry; Mike's note: "He has vault access, you could just point him at sops for that." Transcribing is redundant work, bloats the message, and risks drift from the source of truth — the vault entry is canonical and self-updating.
+
+**How to apply:**
+- Give the vault path + the one or two anchors needed to act (e.g. "wrapper at `C:\tools\trusted-signing\sign.ps1` on Pluto; full details in `services/azure-trusted-signing.sops.yaml`").
+- Let the teammate `sops -d` / `vault.sh get` the rest themselves.
+- Still never paste secrets into shared channels regardless — but for vault-access teammates, the default is "here's the path," not "here's the contents."
+- This applies to teammates with vault access (Howard, Mike). For someone without vault access, transcribe the non-secret fields they need.