diff --git a/.github/workflows/platform-prod-secrets.yml b/.github/workflows/platform-prod-secrets.yml
new file mode 100644
index 000000000000..fe9d2f6b86a5
--- /dev/null
+++ b/.github/workflows/platform-prod-secrets.yml
@@ -0,0 +1,53 @@
+name: Platform production secrets
+
+# One-off. cmux-platform-production is taking over NEXT Cloud's CloudDO routes from cmux-api production
+# (the CloudDO move into cmux-platform) and needs the same JWT_PRIVATE_JWK and CLOUD_LINK_SIGNING_KEYS as
+# cmux-api production, plus a Freestyle key. The cmux-next-production environment is the only GitHub copy;
+# this job pipes what it holds (stdin, never logged) into the Worker's secrets. It writes only these three
+# names, only when the Worker lacks the name (it never overwrites one), and prints no value. A name the
+# environment does not hold is skipped with a notice. Same pattern as platform-dev-secrets.yml (#30461).
+# GitHub registers dispatch workflows only from the default branch (main), so this also runs on the
+# push that lands it on feat-cmux-next (path-filtered to this file). A follow-up drops the push trigger.
+on:
+  push:
+    branches: [feat-cmux-next]
+    paths: [.github/workflows/platform-prod-secrets.yml]
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: platform-prod-secrets
+  cancel-in-progress: false
+
+jobs:
+  put:
+    if: github.ref == 'refs/heads/feat-cmux-next'
+    runs-on: ${{ vars.LINUX_RUNNER || 'blacksmith-4vcpu-ubuntu-2404' }}
+    environment: cmux-next-production
+    timeout-minutes: 10
+    steps:
+      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+        with:
+          node-version: "24"
+      - name: Put missing JWT_PRIVATE_JWK, CLOUD_LINK_SIGNING_KEYS and CLOUD_FREESTYLE_API_KEY on cmux-platform-production
+        env:
+          CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}
+          CLOUDFLARE_ACCOUNT_ID: 0c1675e0def6de1ab3a50a4e17dc5656
+          JWT_PRIVATE_JWK: ${{ secrets.JWT_PRIVATE_JWK }}
+          CLOUD_LINK_SIGNING_KEYS: ${{ secrets.CLOUD_LINK_SIGNING_KEYS }}
+          CLOUD_FREESTYLE_API_KEY: ${{ secrets.FREESTYLE_API_KEY }}
+        run: |
+          set -euo pipefail
+          cd "$RUNNER_TEMP"
+          W=cmux-platform-production
+          WR="npx -y wrangler@4.156.0"
+          $WR secret list --name "$W" --format json > existing.json
+          node -e 'for (const s of JSON.parse(require("fs").readFileSync("existing.json","utf8"))) console.log(s.name)' > existing.txt
+          for NAME in JWT_PRIVATE_JWK CLOUD_LINK_SIGNING_KEYS CLOUD_FREESTYLE_API_KEY; do
+            if grep -qx "$NAME" existing.txt; then echo "::notice::$W already has $NAME; left as is"; continue; fi
+            if [ -z "${!NAME}" ]; then echo "::warning::cmux-next-production holds no copy for $NAME; skipped"; continue; fi
+            printf '%s' "${!NAME}" | $WR secret put "$NAME" --name "$W"
+          done
+          $WR secret list --name "$W" --format json | node -e 'let d="";process.stdin.on("data",c=>d+=c).on("end",()=>{for (const s of JSON.parse(d)) console.log(s.name)})'