diff --git a/.gitignore b/.gitignore
index 30c4de8..cba977e 100644
--- a/.gitignore
+++ b/.gitignore
@@ -3,19 +3,27 @@
 .idea/
 .zed/
 
+
 .DS_Store
 .env
+
+# Terraform state files
 *.tfstate
 *.tfstate.*
 *.tfplan
 .terraform/
 infra/terraform.tfvars
 infra/**/*.tfvars
+
+# Ansible specific
 ansible/inventory/hosts.yml
 ansible/inventory/group_vars/all/main.yml
 ansible/inventory/group_vars/all/vault.yml
 ansible/inventory/group_vars/prod/vault.yml
 ansible/inventory/group_vars/staging/vault.yml
+ansible/.vault_pass.txt
+
+# App build output
 app/bin/
 app/tailwindcss
 
diff --git a/README.md b/README.md
index 06fca65..70c6bba 100644
--- a/README.md
+++ b/README.md
@@ -363,10 +363,22 @@ cd ansible
 ansible-playbook -i inventory/hosts.yml playbooks/setup-node.yml --ask-vault-pass
 ```
 
-The Make deployment target loads `ansible/ansible.cfg` by changing into that directory and regenerates inventory before deployment. Configure `ANSIBLE_VAULT_PASSWORD_FILE` so both playbooks can unlock the Vault files non-interactively:
+For non-interactive deployments, Ansible needs a file containing the password used to encrypt all three Vault files. The project configuration defaults to `ansible/.vault_pass.txt`; create it from the example, replace the placeholder with the Vault password, and restrict its permissions:
+
+```sh
+cp ansible/.vault_pass.txt.example ansible/.vault_pass.txt
+chmod 600 ansible/.vault_pass.txt
+```
+
+`ansible/.vault_pass.txt` is ignored by Git and must never be committed. All three Vault files must use the password stored in this file. To keep the password outside the repository instead, set `ANSIBLE_VAULT_PASSWORD_FILE`:
 
 ```sh
 export ANSIBLE_VAULT_PASSWORD_FILE="$HOME/.config/ansible/todo-vault-password"
+```
+
+The Make deployment target loads `ansible/ansible.cfg`, regenerates inventory, and unlocks the Vault files non-interactively:
+
+```sh
 make deploy-ansible
 ```
 
diff --git a/ansible/.vault_pass.txt.example b/ansible/.vault_pass.txt.example
new file mode 100644
index 0000000..6f93739
--- /dev/null
+++ b/ansible/.vault_pass.txt.example
@@ -0,0 +1 @@
+your-vault-password
\ No newline at end of file
diff --git a/ansible/ansible.cfg b/ansible/ansible.cfg
index 2c04a37..8fbfc7d 100644
--- a/ansible/ansible.cfg
+++ b/ansible/ansible.cfg
@@ -4,6 +4,7 @@ roles_path = roles
 interpreter_python = auto_silent
 host_key_checking = True
 retry_files_enabled = False
+vault_password_file = .vault_pass.txt
 
 [ssh_connection]
 ssh_args = -o StrictHostKeyChecking=accept-new