diff --git a/public/blog/outbound-only-exposure.webp b/public/blog/outbound-only-exposure.webp
new file mode 100644
index 0000000..613a299
Binary files /dev/null and b/public/blog/outbound-only-exposure.webp differ
diff --git a/public/blog/secret-zero.webp b/public/blog/secret-zero.webp
new file mode 100644
index 0000000..d7af77c
Binary files /dev/null and b/public/blog/secret-zero.webp differ
diff --git a/src/content/blog/outbound-only-exposure.md b/src/content/blog/outbound-only-exposure.md
index ca7b3a8..571ae4f 100644
--- a/src/content/blog/outbound-only-exposure.md
+++ b/src/content/blog/outbound-only-exposure.md
@@ -4,6 +4,9 @@ date: 2026-06-23
 summary: "Exposing self-hosted services to the internet with zero open ports, zero port-forwarding, and the origin's IP never leaving the building."
 tags: ["cloudflare", "networking", "security", "zero-trust", "kubernetes"]
 draft: false
+hero: "/blog/outbound-only-exposure.webp"
+heroAlt: "A smooth sealed dark monolith with no doors; a single thin thread of light arcs out from inside it to a distant glowing cloud-edge node."
+
 ---
 
 The default way to put a home service on the internet is to forward a port: poke a hole in the router, map
diff --git a/src/content/blog/secret-zero.md b/src/content/blog/secret-zero.md
index 5a69590..a1e3bf2 100644
--- a/src/content/blog/secret-zero.md
+++ b/src/content/blog/secret-zero.md
@@ -4,6 +4,9 @@ date: 2026-06-28
 summary: "Secrets management has a bootstrap paradox: the credential that pulls every other secret can't itself live in git. Here's how a homelab fleet breaks the cycle — zero plaintext secrets in any repo, and a clean rule for which is the one exception."
 tags: ["security", "gitops", "secrets", "kubernetes", "external-secrets"]
 draft: false
+hero: "/blog/secret-zero.webp"
+heroAlt: "A single glowing seed-shaped key at the base of a dark circuit-board tree whose traces branch upward into hundreds of faint nodes, all drawing their glow from that one source."
+
 ---
 
 ![A single glowing seed-key at the root of a circuit-board tree](/blog/secret-zero.webp)