diff --git a/.gitignore b/.gitignore
new file mode 100644
index 0000000..e78953e
--- /dev/null
+++ b/.gitignore
@@ -0,0 +1,2 @@
+# Vault credentials – never commit these
+manifests/vault/vault-credentials.json