diff --git a/.gitignore b/.gitignore
index 3a26b5e..4757231 100644
--- a/.gitignore
+++ b/.gitignore
@@ -16,3 +16,6 @@ build/
 examples/
 
 src/create_dlthub_workspace/_telemetry_key.py
+
+# Local release envs loaded by the Makefile
+.make.env
diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
index 44e9c27..0b99698 100644
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@@ -115,6 +115,10 @@ DLTHUB_START_POSTHOG_HOST=https://eu.i.posthog.com \
   uv run dlthub-start my-workspace --setup-only
 ```
 
+For releases, put the real key in a gitignored `.make.env`
+(`DLTHUB_START_POSTHOG_KEY=phc_...`); the Makefile loads it into `uv build`, and
+`make publish` refuses to run without it.
+
 ## Tests
 
 Run the fast unit test suite:
diff --git a/Makefile b/Makefile
index 28749dd..3c38ef6 100644
--- a/Makefile
+++ b/Makefile
@@ -1,11 +1,14 @@
 .DEFAULT_GOAL := help
 
-.PHONY: help dev test test-integration compile build clean-dist version-upgrade version-upgrade-patch version-upgrade-minor version-upgrade-major publish ci workspace workspace-env workspace-local workspace-stage workspace-dev workspace-here lint lint-fix format format-check fl lint-ci generate-ai update-ai check-ai lock-upgrade lock-check scaffold-lock-upgrade scaffold-lock-check scaffold-launcher-deps-check
+.PHONY: help dev test test-integration compile build clean-dist version-upgrade version-upgrade-patch version-upgrade-minor version-upgrade-major require-posthog-key publish ci workspace workspace-env workspace-local workspace-stage workspace-dev workspace-here lint lint-fix format format-check fl lint-ci generate-ai update-ai check-ai lock-upgrade lock-check scaffold-lock-upgrade scaffold-lock-check scaffold-launcher-deps-check
 
 PYTHONPYCACHEPREFIX ?= /tmp/create-dlthub-pyc
 PACKAGE_MODULES := $(wildcard src/create_dlthub_workspace/*.py)
 PYTHON_SOURCES := src tests tests_integration scripts
 
+-include .make.env
+export DLTHUB_START_POSTHOG_KEY
+
 help: ## Show this help message
 	@echo "Available targets:"
 	@grep -E '^[a-zA-Z0-9_.-]+:.*?## .*$$' $(MAKEFILE_LIST) \
@@ -86,7 +89,13 @@ version-upgrade-minor: ## Bump the minor version non-interactively (AI/CI-friend
 version-upgrade-major: ## Bump the major version non-interactively (AI/CI-friendly)
 	@$(MAKE) version-upgrade LEVEL=major
 
-publish: clean-dist build ## Build and publish dlthub-start to PyPI
+require-posthog-key:
+	@case "$(DLTHUB_START_POSTHOG_KEY)" in \
+		phc_*) ;; \
+		*) echo "publish: DLTHUB_START_POSTHOG_KEY not set (or not a phc_ key) — add it to .make.env"; exit 1;; \
+	esac
+
+publish: require-posthog-key clean-dist build ## Build and publish dlthub-start to PyPI
 	ls -l dist/
 	@bash -c 'read -s -p "Enter PyPI API token: " PYPI_API_TOKEN; echo; \
 	uv publish --token "$$PYPI_API_TOKEN"'