diff --git a/README.md b/README.md
index a22a237..eea268a 100644
--- a/README.md
+++ b/README.md
@@ -422,10 +422,15 @@ it. The deployer already holds HYPE, because that is what it pays gas in, so it
 credits itself:
 
 ```sh
-HYPERCORE_CREDIT_WEI=10000000000000000 DEPLOYMENT_KEY=0x... \
+read -rs DEPLOYMENT_KEY && export DEPLOYMENT_KEY
+HYPERCORE_CREDIT_WEI=10000000000000000 \
   nix develop -c forge script script/CreditHyperCore.sol:CreditHyperCore --legacy
 ```
 
+The key is read rather than written into the command, because a
+`DEPLOYMENT_KEY=0x...` prefix is a private key in the shell's history file,
+where it outlives the run and the terminal both.
+
 Run exactly that first, without `--broadcast`: it is a dry run against a fork of
 HyperEVM that executes every guard and the transfer itself and sends nothing, so
 anything the real run would refuse is refused there for free. Add `--broadcast`
diff --git a/script/CreditHyperCore.sol b/script/CreditHyperCore.sol
index 9566085..e85890f 100644
--- a/script/CreditHyperCore.sol
+++ b/script/CreditHyperCore.sol
@@ -34,10 +34,15 @@ import {LibHyperCore} from "../src/lib/LibHyperCore.sol";
 /// It is run by hand instead:
 ///
 /// ```sh
-/// HYPERCORE_CREDIT_WEI=10000000000000000 DEPLOYMENT_KEY=0x... \
+/// read -rs DEPLOYMENT_KEY && export DEPLOYMENT_KEY
+/// HYPERCORE_CREDIT_WEI=10000000000000000 \
 ///   forge script script/CreditHyperCore.sol:CreditHyperCore --legacy
 /// ```
 ///
+/// The key is read rather than written into the command: a
+/// `DEPLOYMENT_KEY=0x...` prefix leaves a private key in the shell's history
+/// file, where it outlives both the run and the terminal.
+///
 /// Without `--broadcast` that is a dry run against a fork of HyperEVM, which
 /// executes every guard and the transfer itself and sends nothing. Do that
 /// first: it is the same code path, so anything it refuses is something the