diff --git a/.gitignore b/.gitignore
index 723330d..a8b57e8 100644
--- a/.gitignore
+++ b/.gitignore
@@ -21,3 +21,6 @@ Thumbs.db
 # local dev run logs
 /run.log
 /run.err
+
+# Xray VPN config holds real credentials — keep it server-only.
+deploy/xray/config.json
diff --git a/deploy/xray/README.md b/deploy/xray/README.md
index 7c98f55..d428006 100644
--- a/deploy/xray/README.md
+++ b/deploy/xray/README.md
@@ -11,9 +11,12 @@ pointed at that proxy from the admin panel, and only ingestion traffic goes thro
 
 ## Setup
 
-1. **Put your config** in `deploy/xray/config.json`. Replace the `proxy` outbound with your
-   own vmess / vless / trojan outbound (templates below). Keep the `inbounds` and `routing`
-   sections as-is so the local SOCKS/HTTP ports stay the same.
+1. **Create your config** from the example (it is git-ignored, so deploys never overwrite it):
+   ```bash
+   cp deploy/xray/config.json.example deploy/xray/config.json
+   nano deploy/xray/config.json   # replace the `proxy` outbound with your vmess/vless/trojan
+   ```
+   Keep the `inbounds` and `routing` sections as-is so the local SOCKS/HTTP ports stay the same.
 
 2. **Start the sidecar** (it's behind a compose profile so normal deploys don't run it):
    ```bash
diff --git a/deploy/xray/config.json b/deploy/xray/config.json.example
similarity index 100%
rename from deploy/xray/config.json
rename to deploy/xray/config.json.example