diff --git a/.env.example b/.env.example
index 2b7da58..cf6e8b4 100644
--- a/.env.example
+++ b/.env.example
@@ -17,6 +17,13 @@ DB_DATABASE=ladill_mini
 DB_USERNAME=ladill_mini
 DB_PASSWORD=
 
+# Read platform admin settings (Paystack keys live in ladilldb.platform_settings).
+PLATFORM_DB_HOST=127.0.0.1
+PLATFORM_DB_PORT=3306
+PLATFORM_DB_DATABASE=ladilldb
+PLATFORM_DB_USERNAME=ladill_mini
+PLATFORM_DB_PASSWORD=
+
 SESSION_DRIVER=database
 SESSION_LIFETIME=120
 SESSION_DOMAIN=.ladill.com
@@ -30,9 +37,6 @@ BILLING_API_KEY_MINI=
 IDENTITY_API_URL=https://ladill.com/api
 IDENTITY_API_KEY_MINI=
 
-PAYSTACK_PUBLIC_KEY=
-PAYSTACK_SECRET_KEY=
-
 AFIA_ENABLED=true
 AFIA_PRODUCT=mini
 AFIA_PROVIDER=openai
diff --git a/DEPLOY.md b/DEPLOY.md
index a6fc8a5..5ccbe70 100644
--- a/DEPLOY.md
+++ b/DEPLOY.md
@@ -16,7 +16,12 @@ never migrate). During cutover, nginx can proxy payment-type codes to this app.
 | `LADILL_SSO_CLIENT_ID` / `LADILL_SSO_CLIENT_SECRET` | `passport:client` on platform |
 | `BILLING_API_KEY_MINI` | platform `.env` + this app |
 | `IDENTITY_API_KEY_MINI` | platform `.env` + this app |
-| `PAYSTACK_PUBLIC_KEY` / `PAYSTACK_SECRET_KEY` | platform Paystack keys (interim until Ladill Pay) |
+| `PLATFORM_DB_*` | read `ladilldb.platform_settings` (Paystack keys from admin → Billing) |
+
+Paystack credentials are **not** duplicated in this app’s `.env`. They are
+configured in the platform admin panel (`/admin/settings` → Billing) and read
+at runtime from `platform_settings` via the `platform` DB connection.
+Grant the app DB user `SELECT` on `ladilldb.platform_settings` only.
 
 ## 1. Gitea repo + CI
 
diff --git a/app/Models/PlatformSetting.php b/app/Models/PlatformSetting.php
new file mode 100644
index 0000000..b3b603b
--- /dev/null
+++ b/app/Models/PlatformSetting.php
@@ -0,0 +1,27 @@
+<?php
+
+namespace App\Models;
+
+use Illuminate\Database\Eloquent\Model;
+
+class PlatformSetting extends Model
+{
+    protected $connection = 'platform';
+
+    protected $fillable = [
+        'group',
+        'key',
+        'label',
+        'description',
+        'type',
+        'value',
+        'is_secret',
+        'is_active',
+    ];
+
+    protected $casts = [
+        'value' => 'array',
+        'is_secret' => 'boolean',
+        'is_active' => 'boolean',
+    ];
+}
diff --git a/app/Services/Billing/PaystackService.php b/app/Services/Billing/PaystackService.php
index 5fb1fdf..c8bc514 100644
--- a/app/Services/Billing/PaystackService.php
+++ b/app/Services/Billing/PaystackService.php
@@ -68,10 +68,17 @@ class PaystackService
             ->asJson();
     }
 
+    protected function settingsConnection(): string
+    {
+        return (string) config('billing.platform_settings_connection', 'platform');
+    }
+
     protected function settingValue(string $key, mixed $fallback = null): mixed
     {
         try {
-            if (!Schema::hasTable('platform_settings')) {
+            $connection = $this->settingsConnection();
+
+            if (! Schema::connection($connection)->hasTable('platform_settings')) {
                 return $fallback;
             }
 
diff --git a/config/billing.php b/config/billing.php
index 1c1e166..322961f 100644
--- a/config/billing.php
+++ b/config/billing.php
@@ -4,4 +4,5 @@ return [
     'api_url' => env('BILLING_API_URL', 'https://ladill.com/api/billing'),
     'api_key' => env('BILLING_API_KEY_MINI'),
     'service' => 'mini',
+    'platform_settings_connection' => env('BILLING_PLATFORM_SETTINGS_CONNECTION', 'platform'),
 ];
diff --git a/config/database.php b/config/database.php
index 64709ce..7b97fd2 100644
--- a/config/database.php
+++ b/config/database.php
@@ -64,6 +64,26 @@ return [
             ]) : [],
         ],
 
+        // Read-only access to platform admin settings (Paystack keys, etc.).
+        'platform' => [
+            'driver' => 'mysql',
+            'host' => env('PLATFORM_DB_HOST', env('DB_HOST', '127.0.0.1')),
+            'port' => env('PLATFORM_DB_PORT', env('DB_PORT', '3306')),
+            'database' => env('PLATFORM_DB_DATABASE', 'ladilldb'),
+            'username' => env('PLATFORM_DB_USERNAME', env('DB_USERNAME', 'root')),
+            'password' => env('PLATFORM_DB_PASSWORD', env('DB_PASSWORD', '')),
+            'unix_socket' => env('PLATFORM_DB_SOCKET', env('DB_SOCKET', '')),
+            'charset' => env('DB_CHARSET', 'utf8mb4'),
+            'collation' => env('DB_COLLATION', 'utf8mb4_unicode_ci'),
+            'prefix' => '',
+            'prefix_indexes' => true,
+            'strict' => true,
+            'engine' => null,
+            'options' => extension_loaded('pdo_mysql') ? array_filter([
+                (PHP_VERSION_ID >= 80500 ? Mysql::ATTR_SSL_CA : PDO::MYSQL_ATTR_SSL_CA) => env('MYSQL_ATTR_SSL_CA'),
+            ]) : [],
+        ],
+
         'mariadb' => [
             'driver' => 'mariadb',
             'url' => env('DB_URL'),