diff --git a/.gitignore b/.gitignore
index c5709b1..10e1543 100644
--- a/.gitignore
+++ b/.gitignore
@@ -49,3 +49,9 @@ uv.lock
 # Never-publish workspace material (strategy, prospect research, counsel packs,
 # personal contact details). Created ad hoc; must never reach a remote.
 .private/
+
+# Cover every .env variant, not one at a time. A .env.bak holding live
+# API keys sat in a stash for six weeks and was one `git add -A` from being
+# committed. Negate the committed template so it stays tracked.
+.env.*
+!.env.example