diff --git a/.gitignore b/.gitignore
index 8fce603..00e193d 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1 +1,2 @@
 data/
+config.yaml
diff --git a/README.md b/README.md
index 150c9b4..9879ec0 100644
--- a/README.md
+++ b/README.md
@@ -33,7 +33,14 @@ go run ./tools/hashpwd mysecretpassword
 # Outputs: $2b$12$...
 ```
 
-### 3. Edit `config.yaml`
+### 3. Create your `config.yaml`
+
+Copy the example config and edit it — `config.yaml` is git-ignored so your
+real credentials/domain never get committed:
+
+```bash
+cp config.example.yaml config.yaml
+```
 
 Replace the placeholder hashes with your real bcrypt hashes:
 
@@ -205,7 +212,7 @@ caldav-server/
 │   ├── store/           # filesystem storage layer
 │   └── webdav/          # WebDAV file handler
 ├── tools/hashpwd/       # bcrypt password hasher CLI
-├── config.yaml          # sample configuration
+├── config.example.yaml  # sample configuration (copy to config.yaml)
 ├── Dockerfile
 ├── docker-compose.yaml
 └── Makefile
diff --git a/config.yaml b/config.example.yaml
similarity index 100%
rename from config.yaml
rename to config.example.yaml