diff --git a/.gitignore b/.gitignore
index 982e4cd8..2f0ad7c4 100644
--- a/.gitignore
+++ b/.gitignore
@@ -90,3 +90,7 @@ uploads/
 .claude/hooks/pre-deployment-check.js
 .claude/hooks/pre-deployment-verify.js
 docs/research/
+
+# Credential files (must never be tracked)
+.admin-credentials.local
+.env.backup*