diff --git a/.gitignore b/.gitignore
index 41df5d3..ffc2a33 100644
--- a/.gitignore
+++ b/.gitignore
@@ -66,3 +66,6 @@ bootstrap-argocd.log
 # one line here, which is how a plaintext deploy key reached a public remote.
 k8s/**/*-secret.yaml
 !k8s/**/*.enc.yaml
+
+# IAM provisioning scripts contain credential references — never commit
+scripts/iam/*.py