diff --git a/.github/workflows/aws-cdk.yml b/.github/workflows/aws-cdk.yml
index be31310..9aaba2c 100644
--- a/.github/workflows/aws-cdk.yml
+++ b/.github/workflows/aws-cdk.yml
@@ -226,6 +226,22 @@ jobs:
               ;;
           esac
 
+      - name: Export extra environment variables
+        env:
+          EXTRA_VARS: ${{ vars.EXTRA_VARS }}
+          EXTRA_SECRETS: ${{ secrets.EXTRA_SECRETS }}
+        run: |
+          if [ -n "$EXTRA_VARS" ]; then
+            while IFS= read -r line; do
+              [ -n "$line" ] && echo "$line" | tr -d '\r' >> "$GITHUB_ENV"
+            done <<< "$EXTRA_VARS"
+          fi
+          if [ -n "$EXTRA_SECRETS" ]; then
+            while IFS= read -r line; do
+              [ -n "$line" ] && echo "$line" | tr -d '\r' >> "$GITHUB_ENV"
+            done <<< "$EXTRA_SECRETS"
+          fi
+
       - name: Set CDK commands
         id: parse-cdk-config
         env:
diff --git a/docs/aws-cdk.md b/docs/aws-cdk.md
index 6ce197e..2cfd288 100644
--- a/docs/aws-cdk.md
+++ b/docs/aws-cdk.md
@@ -55,6 +55,14 @@ These should be configured in your GitHub Environment (or at the repository leve
 
 > **Authentication:** Configure either static credentials (`AWS_ACCESS_KEY_ID` + `AWS_SECRET_ACCESS_KEY`) **or** OIDC (`AWS_ROLE_ARN`). The workflow auto-detects which method to use.
 
+**Extras** — optional:
+
+| Name | Type | Description |
+|------|------|-------------|
+| `EXTRA_VARS` | Variable | Additional non-secret environment variables to inject into the deploy step |
+| `EXTRA_SECRETS` | Secret | Additional secret environment variables to inject into the deploy step |
+
+Both extra fields accept multiline `KEY=VALUE` pairs — one per line. Use these for runtime configuration that varies per project, such as feature flags.
 
 #### **Outputs**
 | Name | Description |