diff --git a/.dockerignore b/.dockerignore
index 76771d0..2f81628 100644
--- a/.dockerignore
+++ b/.dockerignore
@@ -12,3 +12,6 @@ ingest_raw/
 rarw*.txt
 inertia.txt
 *.xlsx
+# SQL dumps — customer/order PII + WP password hashes. Never bake into the image;
+# the app's startup DDL is inline in app/main.py, so no .sql is needed at runtime.
+*.sql
diff --git a/.gitignore b/.gitignore
index b760a93..124e669 100644
--- a/.gitignore
+++ b/.gitignore
@@ -12,4 +12,5 @@ inertia.txt
 # live-site MariaDB dumps for 3D-store/editor data work — full site export, carries customer/
 # order PII. Local-only; another lane consumes it for robotmonster.party/store racks + editor.
 site-update.sql
+customers*.sql
 *-dump.sql