diff --git a/.env.example b/.env.example
index 60581237..d85cc8d7 100644
--- a/.env.example
+++ b/.env.example
@@ -25,3 +25,9 @@
 
 # Another common use case is to set Drush's --uri via environment.
 # DRUSH_OPTIONS_URI=http://example.com
+
+# Stripe secret key for the "stripe" commerce payment gateway. Kept out of
+# config/sync (which ships an empty secret_key) and injected in settings.php
+# via getenv('STRIPE_SECRET_KEY'). Use a live key in production, a test key
+# (sk_test_...) everywhere else.
+# STRIPE_SECRET_KEY=
diff --git a/config/sync/commerce_payment.commerce_payment_gateway.stripe.yml b/config/sync/commerce_payment.commerce_payment_gateway.stripe.yml
index 78c53b93..0f60a5f4 100644
--- a/config/sync/commerce_payment.commerce_payment_gateway.stripe.yml
+++ b/config/sync/commerce_payment.commerce_payment_gateway.stripe.yml
@@ -15,7 +15,7 @@ configuration:
     - credit_card
   collect_billing_information: true
   publishable_key: pk_live_51I7RAuBp8BkjanLQp3lsf7QBqO1xhRj8gLEbH4ivBEiZhkGwxgrQNGGizo5yk7HgxkiW3jRY6M4ni8pVfBTt5DGW00nBUevKbl
-  secret_key: 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
+  secret_key: ''
   enable_credit_card_icons: false
 conditions: {  }
 conditionOperator: AND