diff --git a/ZHelpers.ps1 b/ZHelpers.ps1
index 7bd7467..a5127d4 100644
--- a/ZHelpers.ps1
+++ b/ZHelpers.ps1
@@ -177,10 +177,16 @@ function Get-ArchiveExcludes {
     $byKind = switch ([string]$Project.kind) {
         "python" {
             $list = @(".venv", "venv", "__pycache__", ".pytest_cache", ".nicegui", "archive", "dist", "build", "htmlcov")
-            if (-not $ForBackup) { $list += "uploads" }   # deploys exclude user uploads; backups keep them
+            # Deploys exclude user uploads + local .env secrets (server keeps its
+            # own, preserved across deploys); backups keep both for completeness.
+            if (-not $ForBackup) { $list += @("uploads", ".env", ".env.local", ".env.production") }
+            $list
+        }
+        "vite"   {
+            $list = @("node_modules", "dist")
+            if (-not $ForBackup) { $list += @(".env", ".env.local", ".env.production") }
             $list
         }
-        "vite"   { @("node_modules", "dist") }
         "nextjs" { @("node_modules", ".next", ".env", ".env.local", ".env.production", ".vercel", "coverage", "out", "build", "next-env.d.ts") }
         default  { @() }
     }
diff --git a/bash/zhelpers.sh b/bash/zhelpers.sh
index 81d2ae6..9586d57 100644
--- a/bash/zhelpers.sh
+++ b/bash/zhelpers.sh
@@ -217,8 +217,11 @@ z_archive_excludes() {
   case "$kind" in
     python)
       printf '%s\n' .venv venv __pycache__ .pytest_cache .nicegui archive dist build htmlcov
-      [ "$for_backup" -eq 1 ] || printf '%s\n' uploads ;;  # deploys exclude user uploads; backups keep them
-    vite)   printf '%s\n' node_modules dist ;;
+      # deploys exclude user uploads + local .env secrets; backups keep both
+      [ "$for_backup" -eq 1 ] || printf '%s\n' uploads .env .env.local .env.production ;;
+    vite)
+      printf '%s\n' node_modules dist
+      [ "$for_backup" -eq 1 ] || printf '%s\n' .env .env.local .env.production ;;
     nextjs) printf '%s\n' node_modules .next .env .env.local .env.production .vercel coverage out build next-env.d.ts ;;
   esac
   jq -r --arg k "$key" '.projects[$k].deploy.exclude // [] | .[]' "$ZCONFIG"