diff --git a/.dockerignore b/.dockerignore
index 4a2324570..f1bf829df 100644
--- a/.dockerignore
+++ b/.dockerignore
@@ -1,3 +1,8 @@
 .git/*
 .gitignore
 log/*
+
+# Generated at runtime and mounted in by compose. A local copy baked into the
+# image would be loaded by dotenv, silently overriding the intended config.
+.env
+.env.*.local
diff --git a/.gitignore b/.gitignore
index bc757bbf7..75d4d90a7 100644
--- a/.gitignore
+++ b/.gitignore
@@ -33,5 +33,8 @@ spec/examples.txt
 tsconfig.tsbuildinfo
 .eslintcache
 
-# Ignore local environment variable files.
+# Ignore local environment variable files. The docker setup generates real
+# secrets into .env, so it must never be committed; .env.development and
+# .env.test hold placeholders only and are tracked deliberately.
+.env
 .env.*.local
diff --git a/.stringer.env b/.stringer.env
deleted file mode 100644
index 12499378e..000000000
--- a/.stringer.env
+++ /dev/null
@@ -1,8 +0,0 @@
-SECRET_KEY_BASE=5e1a0474b6c8b517c58a676bb9baae9da8fc82d4c5a13a42a1b69c3b310fe666ff824bfe9426db1c0814ea83fdacb1a8f80eed90ae3501006ea17440136620d9
-ENCRYPTION_PRIMARY_KEY=773dddc695536c2e7bcfe7e56f1bfc9ba29a793663304a6b6ef4764867fd7fdb93b9bbf52f3cf67b11b5bcb31d1da3583202e216e08d645363d453feef776a60
-ENCRYPTION_DETERMINISTIC_KEY=a827a6e936dec463b1635803bb19b96815b74e7aa871c656ac8bce45c070dbdf893300ff5e633ee5143efcf5915ee52c760d851e1bfb48f794ac12a40d433398
-ENCRYPTION_KEY_DERIVATION_SALT=63a7e1e618d35721a98d9d71628bda6d5e4b154f5357ad84d78b20b3be09416a204dce57ba1bf1946cfcad05cc990ffc6e8693d801ee4b184d6ba92d5831d68a
-
-DATABASE_URL=postgres://:@/
-FETCH_FEEDS_CRON='*/5 * * * *'
-CLEANUP_CRON='0 0 * * *'