diff --git a/internal/config/config.go b/internal/config/config.go
index fb6e02d..9725a66 100644
--- a/internal/config/config.go
+++ b/internal/config/config.go
@@ -44,6 +44,12 @@ const (
 	keyCacheMaxBytes              = "cache_max_bytes"
 )
 
+// placeholderSigningKey is the dummy signing_key shipped in
+// config.example.yml. It is 45 characters, so it passes the length
+// check, but it is public in this repository and must be rejected at
+// startup so no deployment ever signs URLs with it.
+const placeholderSigningKey = "CHANGE_ME_generate_with_openssl_rand_base64_32"
+
 // Static validation errors. Each use site attaches the offending key
 // and value by wrapping these with fmt.Errorf and %w.
 var (
diff --git a/internal/config/config_validation_internal_test.go b/internal/config/config_validation_internal_test.go
index ca1573e..c12d27d 100644
--- a/internal/config/config_validation_internal_test.go
+++ b/internal/config/config_validation_internal_test.go
@@ -303,6 +303,11 @@ func invalidHostAndCredentialCases() []abortCase {
 			yaml:              "signing_key: short\n",
 			wantErrSubstrings: []string{keySigningKey},
 		},
+		{
+			name:              "signing_key is the documented placeholder",
+			yaml:              "signing_key: " + placeholderSigningKey + "\n",
+			wantErrSubstrings: []string{keySigningKey},
+		},
 		{
 			name:              "signing_key missing",
 			yaml:              "port: 8080\n",