diff --git a/.env b/.env
deleted file mode 100644
index d37d0e0..0000000
--- a/.env
+++ /dev/null
@@ -1,67 +0,0 @@
-# ============================================================================
-# Krow backend — example environment
-#
-# Copy to .env and fill in. .env is gitignored and must never be committed.
-# Every value below is a placeholder or a safe local default: no real password,
-# API key or token belongs in this file.
-#
-#   cp .env.example .env
-# ============================================================================
-
-# ── Application ─────────────────────────────────────────────────────────────
-APP_ENV=development
-LOG_LEVEL=info               # debug | info | warn | error
-
-# ── HTTP server ─────────────────────────────────────────────────────────────
-HTTP_HOST=127.0.0.1
-HTTP_PORT=8080
-HTTP_READ_TIMEOUT=15s
-# An agent run on the deep tier may legally take 2m0s. A 30s write timeout
-# aborted the response mid-run and the proxy reported it as 502.
-HTTP_WRITE_TIMEOUT=2m30s
-HTTP_IDLE_TIMEOUT=60s
-HTTP_SHUTDOWN_TIMEOUT=10s
-
-# ── PostgreSQL ──────────────────────────────────────────────────────────────
-# The local development database. DATABASE_NAME is mixed-case and hyphenated,
-# so anything that interpolates it into SQL must quote it: "Krow-force".
-DATABASE_HOST=127.0.0.1
-DATABASE_PORT=5432
-DATABASE_NAME=Krow-force
-DATABASE_USER=postgres
-DATABASE_PASSWORD=
-DATABASE_SCHEMA=public
-
-# sslmode: disable is fine for a loopback dev database. APP_ENV=production
-# rejects `disable` at startup — use require or verify-full there.
-DATABASE_SSLMODE=disable
-
-# Pool and timeout tuning.
-DATABASE_MAX_OPEN_CONNS=25
-DATABASE_MIN_IDLE_CONNS=2
-DATABASE_CONN_MAX_LIFETIME=30m
-DATABASE_CONNECT_TIMEOUT=5s
-DATABASE_STATEMENT_TIMEOUT=10s
-
-# ── Migrations ──────────────────────────────────────────────────────────────
-# Consumed by the Makefile, which builds the golang-migrate URL from the
-# DATABASE_* values above. Keep it pointed at the repository's migrations/.
-MIGRATIONS_DIR=./migrations
-
-# ── Seed ────────────────────────────────────────────────────────────────────
-# The demo fixture, generated from the frontend repository's src/api/seed.js.
-# The Makefile passes an absolute path; this default suits running from the
-# repository root.
-SEED_FIXTURE_PATH=./seed/fixtures/seed.json
-
-# ── Model gateway ───────────────────────────────────────────────────────────
-ANTHROPIC_API_KEY=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
-
-# ── Knowledge layer (retrieval) ─────────────────────────────────────────────
-# A real semantic embedding model, running locally. No credential, no per-token
-# cost, and no tenant text leaving this machine. Change either of the first two
-# and the stored vectors stop being searched — run `make reembed ORG=<slug>`.
-EMBED_PROVIDER=ollama
-EMBED_MODEL=nomic-embed-text
-EMBED_DIMENSIONS=768
-EMBED_BASE_URL=http://localhost:11434
diff --git a/.gitignore b/.gitignore
index fa38fcf..ea26f67 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1,5 +1,8 @@
 # Secrets and local configuration
 # A bare pattern matches at any depth, so this covers infrastructure/.env too.
+.env
+.env.local
+.env.*.local
 
 # TLS material. The local-db overlay generates a self-signed pair inside the
 # postgres volume, but nothing stops someone dropping certs here by hand.