diff --git a/config/dev.exs b/config/dev.exs
index 9c858d7..94c0a54 100644
--- a/config/dev.exs
+++ b/config/dev.exs
@@ -25,7 +25,7 @@ config :arcadia_cloud, ArcadiaCloudWeb.Endpoint,
 # Guardian — must match arcadia-core's Arcadia.Guardian dev secret_key
 # (shared verbatim with arcadia-social and arcadia-voice).
 config :arcadia_cloud, ArcadiaCloud.Guardian,
-  secret_key: "DuMkIRN3Qcxk8VqOu8nHj5i7a7a7YgBHF4oXqKwDI4A="
+  secret_key: "dev-only-guardian-secret-not-for-production-aaaaaaaaaaaaaaaa="
 
 # skyai-finance push — service-to-service identity for cloud invoice push.
 # tenant_id="platform-admin" lands invoices in the platform's own books;
diff --git a/config/runtime.exs b/config/runtime.exs
index f4908b1..963a081 100644
--- a/config/runtime.exs
+++ b/config/runtime.exs
@@ -32,7 +32,7 @@ config :arcadia_cloud, ArcadiaCloud.Guardian,
     System.get_env("GUARDIAN_SECRET_KEY") ||
       if(config_env() == :prod,
         do: raise("environment variable GUARDIAN_SECRET_KEY is missing"),
-        else: "DuMkIRN3Qcxk8VqOu8nHj5i7a7a7YgBHF4oXqKwDI4A="
+        else: "dev-only-guardian-secret-not-for-production-aaaaaaaaaaaaaaaa="
       )
 
 if config_env() == :prod do