diff --git a/.gitignore b/.gitignore
new file mode 100644
index 0000000..25e4631
--- /dev/null
+++ b/.gitignore
@@ -0,0 +1,2 @@
+secrets.yaml
+.esphome/
diff --git a/README.md b/README.md
index d714b41..f737368 100644
--- a/README.md
+++ b/README.md
@@ -22,8 +22,10 @@ This repo was based on a Python project by [Baldanos](https://github.com/Baldano
 
 ## How to:
 - Flash your device with the [UniSoft firmware](https://github.com/wildekek/rdtech-firmware-unisoft)
+- Copy `secrets.yaml.example` to `secrets.yaml` and fill in WiFi
+  credentials, OTA password, and HA API key. See the comments in that
+  file for details on each value.
 - Create a new ESPHome device and load this [configuration](/rdtech-powersupply.yaml)
-- Update your WiFi credentials in ESPHome
 - [Flash the Riden WiFi module with ESPHome](https://esphome.io/guides/physical_device_connection.html)
 - Set the right settings in the Riden power supply:
 	- UART Interface to "TTL+EN"
diff --git a/secrets.yaml.example b/secrets.yaml.example
new file mode 100644
index 0000000..f81a230
--- /dev/null
+++ b/secrets.yaml.example
@@ -0,0 +1,23 @@
+# Copy this file to `secrets.yaml` in the same directory before running
+# `esphome run rdtech-controller.yaml`. Never commit `secrets.yaml`.
+#
+# All five values are required by the YAML; missing keys will fail the
+# build at compile time with "secret not found" rather than at runtime.
+
+# Wi-Fi the dongle should connect to (2.4 GHz only — ESP8266/ESP-12F
+# has no 5 GHz radio).
+wifi_ssid: "your-2g-ssid"
+wifi_password: "your-wifi-password"
+
+# Captive-portal AP password used when the device fails to join Wi-Fi.
+# Pick something you'll remember; you'll only see it during recovery.
+wifi_fallback_password: "fallback-portal-password"
+
+# OTA update password. Required to push firmware updates wirelessly
+# after the first flash. Generate with e.g. `openssl rand -hex 16`.
+ota_password: "replace-with-32-hex-chars"
+
+# Home Assistant API encryption key (Noise / 32-byte base64). Generate
+# with `openssl rand -base64 32`. Paste the same value into Home
+# Assistant when adopting the device.
+home_assistant_key: "replace-with-44-char-base64-key="