diff --git a/.gitignore b/.gitignore
new file mode 100644
index 0000000..ff4c2c3
--- /dev/null
+++ b/.gitignore
@@ -0,0 +1,13 @@
+# Secrets / credentials — never commit
+.env
+.env.*
+*.env
+secrets.yaml
+secrets.yml
+secrets.*.yaml
+*.key
+*.pem
+*.crt
+credentials
+*credentials*
+*.secret
diff --git a/homepage/services.yaml b/homepage/services.yaml
index 7e80890..6a3c646 100644
--- a/homepage/services.yaml
+++ b/homepage/services.yaml
@@ -200,7 +200,7 @@
         widget:
           type: homeassistant
           url: http://192.168.99.100:8123
-          key: eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiI1MmRhODYzMzFkMDI0NzhiODcxYzhjYjE4MGNhMWEwMCIsImlhdCI6MTc3MDYwODA3MCwiZXhwIjoyMDg1OTY4MDcwfQ.Nwq2auBILpZXsZI1g7mbE8JIBa5XrUwo599oEVCp2QQ
+          key: "{{HOMEPAGE_VAR_HASS_TOKEN}}"
           fields: ["sensor.processor_use", "binary_sensor.update_available"]
 
 - Cloud & Storage: