diff --git a/.gitignore b/.gitignore
index afaf9401..2f898d02 100644
--- a/.gitignore
+++ b/.gitignore
@@ -34,6 +34,12 @@ id_ed25519*
 # Generated deployment config (contains secrets)
 livekit.yaml
 
+# Local deploy targets & private ops notes — REAL hosts/IPs/users for the
+# maintainer's own infra. NEVER commit: this is a public repo. deploy.sh reads
+# .deploy.local at runtime if present; the committed defaults stay placeholders.
+/.deploy.local
+/.deploy-local/
+
 # Raw screenshot originals — optimized WebP copies live in docs/screenshots/
 demo-pictures/
 
diff --git a/deploy.sh b/deploy.sh
index a8ef8150..69359ad8 100755
--- a/deploy.sh
+++ b/deploy.sh
@@ -32,6 +32,16 @@ PI_PATH="~/backspace"
 BETA_HOST="orbit.ddns.net"
 BETA_PATH="~/backspace"
 
+# ── Local target override (gitignored) ──────────────────────
+# The values above are public placeholders. A maintainer can point this script
+# at real infrastructure by creating ./.deploy.local (git-ignored) that reassigns
+# PI_USER / PI_LOCAL / PI_REMOTE / PI_PATH / BETA_HOST / BETA_PATH. This keeps
+# real hostnames, IPs, and usernames out of the public repo. Never commit it.
+if [[ -f ./.deploy.local ]]; then
+  # shellcheck source=/dev/null
+  source ./.deploy.local
+fi
+
 # ── Rsync excludes ──────────────────────────────────────────
 
 EXCLUDES=(