diff --git a/.dockerignore b/.dockerignore
index 3a8e436d515..f24c490e9ad 100644
--- a/.dockerignore
+++ b/.dockerignore
@@ -1,5 +1,11 @@
 .git
 .worktrees
+
+# Sensitive files – docker-setup.sh writes .env with OPENCLAW_GATEWAY_TOKEN
+# into the project root; keep it out of the build context.
+.env
+.env.*
+
 .bun-cache
 .bun
 .tmp