diff --git a/apps/tududi/deployment.yaml b/apps/tududi/deployment.yaml
index 3aeef63..fa89558 100644
--- a/apps/tududi/deployment.yaml
+++ b/apps/tududi/deployment.yaml
@@ -48,6 +48,19 @@ spec:
                   key: session-secret
             - name: TZ
               value: America/Los_Angeles
+            # AI assistant (daily brief, task/project insights). tududi speaks
+            # the OpenAI chat completions API, so it points straight at the
+            # Ollama box; /v1 is required. A key must be set even though Ollama
+            # ignores it -- without one the endpoints answer 503.
+            - name: LLM_BASE_URL
+              value: http://192.168.1.191:11434/v1
+            - name: LLM_MODEL
+              value: gemma4:e4b
+            - name: LLM_API_KEY
+              valueFrom:
+                secretKeyRef:
+                  name: tududi
+                  key: llm-api-key
           ports:
             - name: http
               containerPort: 3002
diff --git a/apps/tududi/secret.example.yaml b/apps/tududi/secret.example.yaml
index 731ebb2..600b920 100644
--- a/apps/tududi/secret.example.yaml
+++ b/apps/tududi/secret.example.yaml
@@ -13,3 +13,7 @@ stringData:
   user-email: you@example.com
   user-password: CHANGE-ME
   session-secret: CHANGE-ME
+  # The AI assistant requires a key to be set even when the provider ignores
+  # it (a local Ollama does). Any non-empty value works there; replace with a
+  # real key if you ever point LLM_BASE_URL at a paid provider.
+  llm-api-key: ollama