diff --git a/.gitignore b/.gitignore
index fbf2d07..8b8a421 100644
--- a/.gitignore
+++ b/.gitignore
@@ -11,3 +11,9 @@ build/
 # Never-publish workspace material (strategy, prospect research, counsel packs,
 # personal contact details). Created ad hoc; must never reach a remote.
 .private/
+
+# Cover every .env variant, not one at a time. A .env.bak holding live
+# API keys sat in a stash for six weeks and was one `git add -A` from being
+# committed. Negate the committed template so it stays tracked.
+.env.*
+!.env.example