diff --git a/cfg/dev.env.example b/.env.example
similarity index 95%
rename from cfg/dev.env.example
rename to .env.example
index d86500c82..1d29a41c5 100644
--- a/cfg/dev.env.example
+++ b/.env.example
@@ -1,11 +1,11 @@
 # Dev overrides for `make dev-config`.
 #
-# Copy this file to cfg/dev.env and uncomment any variable you want to
-# override. cfg/dev.env is gitignored; this .example file is the
-# canonical list of overridable knobs.
+# Copy this file to .env and uncomment any variable you want to
+# override. .env is gitignored; this .env.example is the canonical
+# list of overridable knobs.
 #
 # This is NOT a Docker-compose `.env` file. The Makefile sources it as
-# a POSIX shell snippet (`. cfg/dev.env`), so:
+# a POSIX shell snippet (`. ./.env`), so:
 #   - `KEY=value` works and is auto-exported.
 #   - Quote values containing spaces: `KEY="foo bar"`.
 #   - `#` starts a comment, `export KEY=value` is accepted.
diff --git a/.gitignore b/.gitignore
index c0e586faa..793090886 100644
--- a/.gitignore
+++ b/.gitignore
@@ -21,4 +21,4 @@ pkg/server/api/*/v1/types/types.go
 pkg/server/api/*/v1/schema.graphql
 cfg/dev_local.yaml
 cfg/dev.yaml
-cfg/dev.env
+.env
diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
index 5404a9355..235619930 100644
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@@ -88,12 +88,12 @@ Signed-off-by: John Doe <john.doe@example.org>
 
    ```bash
    # Optional: override any dev default (secrets, OAuth clients, LLM keys).
-   # cp cfg/dev.env.example cfg/dev.env && $EDITOR cfg/dev.env
+   # cp .env.example .env && $EDITOR .env
 
    make dev-config
    ```
 
-   The target stashes a dev-only RSA signing key under `cfg/.dev-oauth2-signing-key.pem` so tokens survive probod restarts, and sources `cfg/dev.env` if present so you can override defaults without editing the Makefile. `cfg/dev.yaml`, `cfg/dev.env`, and the signing key are all gitignored. Re-run the target to regenerate.
+   The target stashes a dev-only RSA signing key under `cfg/.dev-oauth2-signing-key.pem` so tokens survive probod restarts, and sources `.env` if present so you can override defaults without editing the Makefile. `cfg/dev.yaml`, `.env`, and the signing key are all gitignored. Re-run the target to regenerate.
 
 7. Start the development servers:
 
diff --git a/GNUmakefile b/GNUmakefile
index 78e489e41..1086e9da0 100644
--- a/GNUmakefile
+++ b/GNUmakefile
@@ -152,16 +152,16 @@ coverage-combined: coverage-report test-e2e-coverage ## Generate combined covera
 build: bin/probod bin/prb bin/probod-bootstrap
 
 CFG_DEV_OAUTH2_KEY = cfg/.dev-oauth2-signing-key.pem
-CFG_DEV_ENV       = cfg/dev.env
+DEV_ENV            = .env
 
 .PHONY: dev-config
-dev-config: cfg/dev.yaml ## Generate cfg/dev.yaml via probod-bootstrap (picks up edits to cfg/dev.env)
+dev-config: cfg/dev.yaml ## Generate cfg/dev.yaml via probod-bootstrap (picks up edits to .env)
 
 $(CFG_DEV_OAUTH2_KEY):
 	@$(MKDIR) $(@D)
 	$(OPENSSL) genrsa -out $@ 2048
 
-cfg/dev.yaml: bin/probod-bootstrap $(CFG_DEV_OAUTH2_KEY) $(wildcard $(CFG_DEV_ENV))
+cfg/dev.yaml: bin/probod-bootstrap $(CFG_DEV_OAUTH2_KEY) $(wildcard $(DEV_ENV))
 	@$(MKDIR) $(@D)
 	set -a; \
 	PROBOD_ENCRYPTION_KEY="thisisnotasecretAAAAAAAAAAAAAAAAAAAAAAAAAAA="; \
@@ -175,7 +175,7 @@ cfg/dev.yaml: bin/probod-bootstrap $(CFG_DEV_OAUTH2_KEY) $(wildcard $(CFG_DEV_EN
 	AWS_ENDPOINT=http://127.0.0.1:8333; \
 	OPENAI_API_KEY=thisisnotasecret; \
 	ACME_DIRECTORY=https://localhost:14000/dir; \
-	if [ -f $(CFG_DEV_ENV) ]; then . $(CFG_DEV_ENV); fi; \
+	if [ -f $(DEV_ENV) ]; then . $(DEV_ENV); fi; \
 	set +a; \
 	./bin/probod-bootstrap -output $@
 
diff --git a/contrib/claude/config.md b/contrib/claude/config.md
index e20de2741..5ad466d8f 100644
--- a/contrib/claude/config.md
+++ b/contrib/claude/config.md
@@ -44,7 +44,7 @@ Go struct (pkg/probod/)
 1. **Never add a Go config field without updating every file in the checklist.**
 2. **Env var naming** — follow the existing convention in `builder.go`: `SECTION_FIELD_NAME` (e.g. `AUTH_COOKIE_DOMAIN`, `CUSTOM_DOMAINS_RENEWAL_INTERVAL`).
 3. **Secrets** go through `secret.yaml` and are referenced via `secretKeyRef` in `deployment.yaml`. Non-secret values are set inline.
-4. **`make dev-config`** writes `cfg/dev.yaml` via `probod-bootstrap` with safe, non-production defaults (plaintext passwords, `localhost`, `secure: false`). The generated file and the per-dev OAuth2 signing key (`cfg/.dev-oauth2-signing-key.pem`) are both gitignored. The recipe sources `cfg/dev.env` if present so devs can override any env var without editing the `GNUmakefile`; keep `cfg/dev.env.example` in sync when you add or rename env vars.
+4. **`make dev-config`** writes `cfg/dev.yaml` via `probod-bootstrap` with safe, non-production defaults (plaintext passwords, `localhost`, `secure: false`). The generated file and the per-dev OAuth2 signing key (`cfg/.dev-oauth2-signing-key.pem`) are both gitignored. The recipe sources `.env` at the repo root if present so devs can override any env var without editing the `GNUmakefile`; keep `.env.example` in sync when you add or rename env vars.
 5. **`e2e/internal/testutil/testutil.go`** builds the e2e config through `bootstrap.NewBuilder` with a test-only env-var map (different ports, `probod_test` DB, shorter intervals). Any new field whose test value differs from the bootstrap default must be added to that map.
 6. **`provision.sh`** only sets env vars that differ from `builder.go` defaults (e.g. `PROBOD_BASE_URL`, `AUTH_COOKIE_DOMAIN`, `AUTH_COOKIE_SECURE`). If the new field's default is acceptable in the sandbox, no env var is needed.
 7. **Helm `values.yaml`** exposes the field under the appropriate `probo.*` key with a sensible default. `values-production.yaml.example` includes it only when the production value differs or the user must set it.