diff --git a/.gitignore b/.gitignore
index baaa4842..bebd1a92 100644
--- a/.gitignore
+++ b/.gitignore
@@ -65,3 +65,10 @@ paper/build/
 # Never-publish workspace material (strategy, prospect research, counsel packs,
 # personal contact details). Created ad hoc; must never reach a remote.
 .private/
+
+# Cover every .env variant, not one at a time. A .env.bak holding live
+# API keys sat in a stash for six weeks and was one `git add -A` from being
+# committed; .env.backup had already been added by hand after an earlier
+# near-miss. Negate the committed template so it stays tracked.
+.env.*
+!.env.example