diff --git a/app/phpunit.xml b/app/phpunit.xml
index e1ae2dfe..dbb4d1c6 100644
--- a/app/phpunit.xml
+++ b/app/phpunit.xml
@@ -28,9 +28,8 @@
         <env name="CACHE_STORE" value="array"/>
         <env name="DB_CONNECTION" value="pgsql"/>
         <env name="DB_DATABASE" value="liderra_testing"/>
-        <env name="DB_USERNAME" value="postgres"/>
-        <!-- DB_PASSWORD: worktree-local override (no .env.testing in this worktree). NOT for production. -->
-        <env name="DB_PASSWORD" value="liderra_dev_pass"/>
+        <!-- DB_USERNAME / DB_PASSWORD come from the untracked local .env (dev creds). -->
+        <!-- Not hardcoded here so no secret is committed to git. -->
         <env name="DB_URL" value=""/>
         <env name="MAIL_MAILER" value="array"/>
         <env name="AUTH_PASSWORD_RESET_TOKEN_TABLE" value="password_resets" force="true"/>