diff --git a/docs/src/content/docs/reference/glossary.md b/docs/src/content/docs/reference/glossary.md
index 452d1dc42e2..63efb62ec11 100644
--- a/docs/src/content/docs/reference/glossary.md
+++ b/docs/src/content/docs/reference/glossary.md
@@ -1292,6 +1292,18 @@ sandbox:
       - /run/docker.sock:/var/run/docker.sock:ro
 ```
 
+### Excluded Env (`excluded-env`)
+
+A top-level frontmatter field that lists environment variable names to unconditionally exclude from the AWF agent container via `--exclude-env`. Use this when an environment variable is set from a source the compiler cannot automatically detect as credential-bearing — for example, a `workflow_dispatch` input that carries an ephemeral token generated by an upstream job. Names are deduplicated and merged with those auto-detected from `secrets.*` and `needs.*.outputs.*` references.
+
+```aw wrap
+excluded-env:
+  - MY_DISPATCH_TOKEN
+  - ANOTHER_SENSITIVE_VAR
+```
+
+See [Sandbox Configuration](/gh-aw/reference/sandbox/).
+
 ### `sandbox.agent.runtime`
 
 A `sandbox.agent` field that selects the container runtime used to execute the AI agent. Supported values: