diff --git a/docs/explanation/architecture.md b/docs/explanation/architecture.md
index 789f26a..4ad3b27 100644
--- a/docs/explanation/architecture.md
+++ b/docs/explanation/architecture.md
@@ -644,7 +644,8 @@ Relax the write policy to accept all repository announcements regardless of clon
 
 ```bash
 cargo build --release
-./target/release/ngit-grasp --domain example.com --owner-npub npub1...
+NGIT_RELAY_OWNER_NSEC=nsec1... \
+  ./target/release/ngit-grasp --domain example.com
 ```
 
 ### Docker
diff --git a/tests/archive_grasp_services.rs b/tests/archive_grasp_services.rs
index e562621..2ac34bc 100644
--- a/tests/archive_grasp_services.rs
+++ b/tests/archive_grasp_services.rs
@@ -66,12 +66,12 @@ async fn start_relay_with_grasp_services(services: &str) -> (Child, String, Path
         .expect("Failed to get grandparent dir")
         .join("ngit-grasp");
 
-    // Generate a test owner npub
+    // Give the relay a stable signing identity for NIP-11 and NIP-42.
     let test_keys = nostr_sdk::prelude::Keys::generate();
-    let test_npub = test_keys
-        .public_key()
+    let test_nsec = test_keys
+        .secret_key()
         .to_bech32()
-        .expect("Failed to generate test npub");
+        .expect("Failed to generate test nsec");
 
     // Start the relay process with archive_grasp_services
     let mut cmd = Command::new(&binary_path);
@@ -79,7 +79,7 @@ async fn start_relay_with_grasp_services(services: &str) -> (Child, String, Path
         .env("NGIT_DOMAIN", &bind_address)
         .env("NGIT_GIT_DATA_PATH", git_data_dir.path())
         .env("NGIT_DATABASE_BACKEND", "memory")
-        .env("NGIT_OWNER_NPUB", &test_npub)
+        .env("NGIT_RELAY_OWNER_NSEC", &test_nsec)
         .env("NGIT_ARCHIVE_GRASP_SERVICES", services)
         .env(
             "RUST_LOG",
diff --git a/tests/common/relay.rs b/tests/common/relay.rs
index ba8fbda..36d2d73 100644
--- a/tests/common/relay.rs
+++ b/tests/common/relay.rs
@@ -464,12 +464,12 @@ impl TestRelay {
             .expect("Failed to get grandparent dir")
             .join("ngit-grasp");
 
-        // Generate a test owner npub (using a random keypair)
+        // Give the relay a stable signing identity for NIP-11 and NIP-42.
         let test_keys = nostr_sdk::prelude::Keys::generate();
-        let test_npub = test_keys
-            .public_key()
+        let test_nsec = test_keys
+            .secret_key()
             .to_bech32()
-            .expect("Failed to generate test npub");
+            .expect("Failed to generate test nsec");
 
         // Build the Command *before* releasing the reservation so that
         // none of the env-setting allocations happen while the listener
@@ -479,7 +479,7 @@ impl TestRelay {
             .env("NGIT_DOMAIN", &bind_address) // Set domain to match bind address
             .env("NGIT_GIT_DATA_PATH", &git_data_path)
             .env("NGIT_RELAY_DATA_PATH", &relay_data_path)
-            .env("NGIT_OWNER_NPUB", &test_npub)
+            .env("NGIT_RELAY_OWNER_NSEC", &test_nsec)
             .env("NGIT_TEST", "1") // Enable test mode: fast timers (200ms batch window, 200ms purgatory sync)
             .env("NGIT_SYNC_STARTUP_DELAY_SECS", "0") // No startup delay for faster tests
             .env("NGIT_SYNC_STARTUP_JITTER_MS", "0") // No jitter for tests