diff --git a/.envrc b/.envrc
new file mode 100644
index 00000000..eb95343b
--- /dev/null
+++ b/.envrc
@@ -0,0 +1,7 @@
+# shellcheck shell=bash
+# shellcheck disable=SC1091
+
+use flake . --impure
+
+dotenv_if_exists .env.local
+
diff --git a/.gitignore b/.gitignore
index 7bc4ce60..6cbe5457 100644
--- a/.gitignore
+++ b/.gitignore
@@ -60,7 +60,8 @@ npm-debug.log
 /priv/plts/
 
 # Environment variables (used by direnv and Kustomize secretGenerator)
-.envrc
+# .envrc is tracked — put local secrets in .envrc.local
+.envrc.local
 k8s/.envrc
 
 /towerops-agent/