diff --git a/secrets/clients/.gitignore b/secrets/clients/.gitignore
new file mode 100644
index 0000000..d1f195d
--- /dev/null
+++ b/secrets/clients/.gitignore
@@ -0,0 +1,13 @@
+# Only allow SOPS-encrypted files in version control
+# Block all plaintext/temp secret files
+
+# Allow only .sops.yaml files
+*.yaml
+!*.sops.yaml
+
+# Block temporary files
+*_temp.yaml
+*_plaintext.yaml
+*-temp.yaml
+*.tmp
+*.backup