diff --git a/.gitignore b/.gitignore
index 6c0a084..750a233 100644
--- a/.gitignore
+++ b/.gitignore
@@ -14,8 +14,9 @@ inventory.ini
 venv/*
 .env
 
-# Secrets and sensitive files
-*_secrets.yml
-*_secrets.yaml
-secrets/
-.secrets/
+# Secrets are ansible-vault encrypted and ARE committed.
+# Anything matching *_secrets.plain.yml is a working decryption — never commit those.
+*_secrets.plain.yml
+
+# Vault password — never commit
+ansible/.vault_pass
\ No newline at end of file
diff --git a/ansible/ansible.cfg b/ansible/ansible.cfg
index 56620fa..aa10181 100644
--- a/ansible/ansible.cfg
+++ b/ansible/ansible.cfg
@@ -7,7 +7,7 @@ stdout_callback      = yaml
 retry_files_enabled  = False
 host_key_checking    = True
 forks                = 10
-# vault_password_file = .vault_pass   # uncomment in Stage 2
+vault_password_file = .vault_pass
 
 [ssh_connection]
 pipelining = True