diff --git a/.gitea/workflows/prepare-release.yml b/.gitea/workflows/prepare-release.yml
index a04980e6..c4a321c3 100644
--- a/.gitea/workflows/prepare-release.yml
+++ b/.gitea/workflows/prepare-release.yml
@@ -79,10 +79,13 @@ jobs:
           import json
           import pathlib
 
+          # NOTE: No ConnectionStrings here on purpose. The real DB
+          # password lives only in /home/kjh2064/.config/quantengine.env
+          # on the production server and is injected via systemd
+          # EnvironmentFile (ConnectionStrings__DefaultConnection),
+          # which overrides this file at runtime. Never bake secrets
+          # into a build artifact that ends up in a Gitea Release.
           config = {
-            "ConnectionStrings": {
-              "DefaultConnection": "Host=127.0.0.1;Database=quantenginedb;Username=quantengine_app;Password=quantengine_app;Search Path=quantengine;"
-            },
             "Logging": {
               "LogLevel": {
                 "Default": "Information"
@@ -96,7 +99,7 @@ jobs:
           )'
 
           test -s ./publish/appsettings.Production.json || { echo "ERROR: appsettings.Production.json is empty"; exit 1; }
-          echo "✓ Production config created"
+          echo "✓ Production config created (no secrets included)"
 
       - name: Package Artifact
         run: |