diff --git a/.gitignore b/.gitignore
index 2a11f27..eb736ea 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1,7 +1,11 @@
-# Secrets — every collection keeps its own .env beside its .env.example
+# Secrets — every collection keeps its own .env beside its .env.example.
+# A pattern with no leading slash matches at EVERY depth, so these cover any
+# .env anywhere in the repo, present or future. `.env.*` catches variants like
+# .env.local / .env.unraid-api; the negation keeps the committed examples.
 .env
-**/.env
-!**/.env.example
+.env.*
+!.env.example
+!.env.*.example
 
 # MemPalace per-project files (issue #185).
 # `mempalace init` ignores both by default. We deliberately track mempalace.yaml —