diff --git a/.env.example b/.env.example
index 7913f204..9963c25d 100644
--- a/.env.example
+++ b/.env.example
@@ -38,6 +38,12 @@ GITHUB_OAUTH_CALLBACK_URL=http://localhost:3000/api/auth/github/callback
 # TODO: migrate to a GitHub App installation token flow for multi-org support.
 GITHUB_API_TOKEN=
 
+# Comma-separated "owner/repo" allowlist for first-time syncs — a repository
+# must be listed here (or already have an assigned maintainer) before it can
+# be synced, otherwise RepoScopeGuard refuses it (#566). Required to sync any
+# new repository.
+GITHUB_SYNC_ALLOWED_REPOS=
+
 # --- GitHub Webhooks -------------------------------------------------------
 # Secret configured on the GitHub repo/organization webhook. Used to verify
 # the `X-Hub-Signature-256` HMAC-SHA256 header on every incoming webhook.