diff --git a/.gitignore b/.gitignore
index 31fd267..0d566cc 100644
--- a/.gitignore
+++ b/.gitignore
@@ -5,8 +5,11 @@ node_modules/
 dist/
 .dist/
 
-# Environment — NEVER commit .env (secrets at rest: DB passwords, OIDC secrets, encryption key)
+# Environment — NEVER commit secrets at rest (DB passwords, OIDC secrets, encryption key,
+# Fastmail app passwords). Ignore .env and every .env.* variant, but keep the example template.
 .env
+.env.*
+!.env.example
 
 # Editor
 .vscode/