diff --git a/web/pay-insights/devops/vaults.gcp.env b/web/pay-insights/devops/vaults.gcp.env
index 0059e313..9e172920 100644
--- a/web/pay-insights/devops/vaults.gcp.env
+++ b/web/pay-insights/devops/vaults.gcp.env
@@ -1,32 +1,22 @@
-# Web URLs
-NUXT_PUBLIC_BASE_URL="op://web-url/$APP_ENV/pay-insights/PAY_INSIGHTS_WEB_URL" # TODO:OP add create vault entry
+NUXT_PUBLIC_BASE_URL="op://web-url/$APP_ENV/pay-insights/PAY_INSIGHTS_WEB_URL"
 NUXT_PUBLIC_REGISTRY_HOME_URL="op://web-url/$APP_ENV/registry/REGISTRY_HOME_URL"
 
-# Status API
 NUXT_PUBLIC_STATUS_API_URL="op://API/$APP_ENV/status-api/STATUS_API_URL"
 NUXT_PUBLIC_STATUS_API_VERSION="op://API/$APP_ENV/status-api/STATUS_API_VERSION"
 
-# LaunchDarkly
 NUXT_PUBLIC_LD_CLIENT_ID="op://launchdarkly/$APP_ENV/pay/PAY_LD_CLIENT_ID"
 
-# Identity Provider (Keycloak)
 NUXT_PUBLIC_IDP_URL="op://keycloak/$APP_ENV/base/KEYCLOAK_AUTH_BASE_URL"
 NUXT_PUBLIC_IDP_REALM="op://keycloak/$APP_ENV/base/KEYCLOAK_REALMNAME"
 NUXT_PUBLIC_SITEMINDER_LOGOUT_URL="op://web-url/$APP_ENV/siteminder/SITEMINDER_LOGOUT_URL"
 
-# Server-side login — pay-insights uses its own public Keycloak client (PKCE, no secret).
-NUXT_IDP_CLIENTID="op://keycloak/$APP_ENV/pay-insights/UI_KEYCLOAK_RESOURCE_NAME" # TODO:OP add provision Keycloak client
+NUXT_IDP_CLIENTID="op://keycloak/$APP_ENV/pay-insights/UI_KEYCLOAK_RESOURCE_NAME"
 
-# Session cookie encryption
-NUXT_SESSION_PASSWORD="op://relationship/$APP_ENV/pay-insights/SESSION_PASSWORD" # TODO:OP add create vault entry
+NUXT_SESSION_PASSWORD="op://relationship/$APP_ENV/pay-insights/SESSION_PASSWORD"
 
-# Data warehouse (Cloud SQL connector, IAM auth — no password)
-# Same vault entries as sbc-pay payment-jobs (DW_UNIX_SOCKET / DW_NAME / DW_IAM_USER)
 NUXT_WAREHOUSE_INSTANCE_CONNECTION_NAME="op://database/$APP_ENV/fin-warehouse/DATABASE_UNIX_SOCKET"
 NUXT_WAREHOUSE_DATABASE="op://database/$APP_ENV/fin-warehouse/DATABASE_NAME"
-# Reuses the payment-jobs read-only IAM user; the Cloud Run service must run as that service account
 NUXT_WAREHOUSE_IAM_USER="op://database/$APP_ENV/fin-warehouse/PAY_JOBS_DW_IAM_USER"
 
-# Content-Security-Policy and log level (same CD entries as web/pay-ui)
 NUXT_CSP_EXTRA="op://CD/$APP_ENV/base/CSP_EXTRA"
-LOG_LEVEL="op://CD/$APP_ENV/pay-insights/LOG_LEVEL" # TODO:OP add LOG_LEVEL (e.g. INFO)
+LOG_LEVEL="op://CD/$APP_ENV/pay-insights/LOG_LEVEL"