diff --git a/.gitignore b/.gitignore
index d04ce2b..3b7a85f 100644
--- a/.gitignore
+++ b/.gitignore
@@ -23,5 +23,9 @@ dist/
 .dev.vars
 .idea
 
+# Local env files (e.g. VITE_SENTRY_DSN for production builds). Vite loads
+# `.env.production.local` automatically; keep the DSN out of this public repo.
+.env*.local
+
 # macOS
 .DS_Store
diff --git a/src/router.tsx b/src/router.tsx
index 7a64e8e..d3fe10c 100644
--- a/src/router.tsx
+++ b/src/router.tsx
@@ -10,7 +10,7 @@ export function getRouter() {
 
   if (!router.isServer) {
     Sentry.init({
-      dsn: 'https://d1893624a683484f8260184a6025be0f@o4503970038611968.ingest.us.sentry.io/4503970040053760',
+      dsn: import.meta.env.VITE_SENTRY_DSN,
       integrations: [],
     });
   }
diff --git a/src/server.ts b/src/server.ts
index bd3eb6e..25ce1fb 100644
--- a/src/server.ts
+++ b/src/server.ts
@@ -13,7 +13,7 @@ async function handler(request: Request, env: Env, ctx: ExecutionContext): Promi
 
 export default Sentry.withSentry(
   () => ({
-    dsn: 'https://d1893624a683484f8260184a6025be0f@o4503970038611968.ingest.us.sentry.io/4503970040053760',
+    dsn: import.meta.env.VITE_SENTRY_DSN,
     sendDefaultPii: false,
   }),
   // @ts-expect-error - TanStack's ServerEntry types fetch as (request, opts?), not (request, env, ctx)
diff --git a/vite-env.d.ts b/vite-env.d.ts
index 11f02fe..60ed4c3 100644
--- a/vite-env.d.ts
+++ b/vite-env.d.ts
@@ -1 +1,5 @@
 /// <reference types="vite/client" />
+
+interface ImportMetaEnv {
+  readonly VITE_SENTRY_DSN?: string;
+}