diff --git a/.cargo/config.toml b/.cargo/config.toml
new file mode 100644
index 0000000..29463db
--- /dev/null
+++ b/.cargo/config.toml
@@ -0,0 +1,8 @@
+# Use system git for fetch (respects ~/.git-credentials and SSH keys),
+# so credentials never get baked into Cargo.lock URLs.
+#
+# Required because the [patch.crates-io] block in Cargo.toml points at
+# the LAN-only Sulkta-Coop/pallas fork. Without this, cargo's internal
+# libgit2 client would prompt for creds and bake them into Cargo.lock.
+[net]
+git-fetch-with-cli = true