diff --git a/.gitignore b/.gitignore
index 9c0d0a93..11e4e7ee 100644
--- a/.gitignore
+++ b/.gitignore
@@ -42,3 +42,10 @@ public/.openadapt-paper.pdf.tmp
 # Never-publish workspace material (strategy, prospect research, counsel packs,
 # personal contact details). Created ad hoc; must never reach a remote.
 .private/
+
+# Cover every .env variant, not one at a time. A .env.bak holding live
+# API keys sat in a stash for six weeks and was one `git add -A` from being
+# committed; .env.backup had already been added by hand after an earlier
+# near-miss. Negate the committed template so it stays tracked.
+.env.*
+!.env.example