diff --git a/CHANGELOG.md b/CHANGELOG.md
index e33c7ea..f94feaf 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -6,6 +6,11 @@ Changelog", this file is a reverse-chronological list of merged pull requests.
 
 ## Open PR's
 
+- [PR-157](https://github.com/itk-dev/devops_itkdev-docker/pull/157) - 2026-10-15 -
+  Traefik reads local dynamic config, such as Agent Proxy services and their
+  API keys, from the untracked `traefik/dynamic.d/`, so it can no longer be
+  committed with the shared `traefik/dynamic-conf.yaml`. Move services you
+  added to `dynamic-conf.yaml` into `dynamic.d/`, and run `traefik:start`
 - [PR-155](https://github.com/itk-dev/devops_itkdev-docker/pull/155) - 2026-10-05 -
   Python template: select the services to lint and test by the label
   `dk.itkdev.language: python` instead of `dk.itkdev.python: "true"`
diff --git a/traefik/docker-compose.yml b/traefik/docker-compose.yml
index 0bba2ec..1186c0b 100644
--- a/traefik/docker-compose.yml
+++ b/traefik/docker-compose.yml
@@ -34,6 +34,8 @@ services:
       - "443:443"
     volumes:
       - $PWD/traefik.yml:/traefik.yml:ro
+      # Untracked local config (e.g. Agent Proxy services) is /config; the shared file is mounted into it.
+      - $PWD/dynamic.d:/config:ro
       - $PWD/dynamic-conf.yaml:/config/dynamic-conf.yaml:ro
       - $PWD/ssl:/certs:ro
     labels:
diff --git a/traefik/dynamic.d/.gitignore b/traefik/dynamic.d/.gitignore
new file mode 100644
index 0000000..666be1a
--- /dev/null
+++ b/traefik/dynamic.d/.gitignore
@@ -0,0 +1,6 @@
+# Local Traefik dynamic configuration, e.g. services written by Agent Proxy.
+# Files here can hold API keys, so nothing in this directory is committed
+# except this file and the mount point for ../dynamic-conf.yaml.
+*
+!.gitignore
+!dynamic-conf.yaml
diff --git a/traefik/dynamic.d/dynamic-conf.yaml b/traefik/dynamic.d/dynamic-conf.yaml
new file mode 100644
index 0000000..94f7b7a
--- /dev/null
+++ b/traefik/dynamic.d/dynamic-conf.yaml
@@ -0,0 +1,3 @@
+# Mount point only. Inside the Traefik container ../dynamic-conf.yaml is
+# mounted over this file, so edits here have no effect. Edit
+# traefik/dynamic-conf.yaml for shared configuration instead.