diff --git a/src/cli.ts b/src/cli.ts
index 1671beb2..1fa8ef78 100644
--- a/src/cli.ts
+++ b/src/cli.ts
@@ -41,6 +41,7 @@ import {
   loadProjectConfig,
   resolveWorkspacePermissions,
 } from "./project_config.ts";
+import { resolveProjectRoot } from "./cli_utils.ts";
 
 const logger = console;
 const DEFAULT_OPENROUTER_BASE_URL = "https://openrouter.ai/api/v1";
@@ -140,11 +141,29 @@ async function resolveBotRoot(opts: {
 }
 
 async function loadGambitEnv() {
-  const envPath = path.resolve(Deno.cwd(), "gambit", ".env");
-  try {
-    await loadDotenv({ envPath, export: true });
-  } catch (err) {
-    if (!(err instanceof Deno.errors.NotFound)) {
+  const cwd = Deno.cwd();
+  const projectRoot = resolveProjectRoot(cwd);
+  const candidates = new Set<string>();
+
+  if (projectRoot) {
+    candidates.add(path.join(projectRoot, ".env"));
+  }
+  candidates.add(path.join(cwd, ".env"));
+
+  // Legacy fallback for old gambit demo layout; prefer root/local .env above.
+  if (projectRoot) {
+    candidates.add(path.join(projectRoot, "gambit", ".env"));
+  }
+  candidates.add(path.join(cwd, "gambit", ".env"));
+
+  for (const envPath of candidates) {
+    try {
+      const info = await Deno.stat(envPath);
+      if (!info.isFile) continue;
+      await loadDotenv({ envPath, export: true });
+      return;
+    } catch (err) {
+      if (err instanceof Deno.errors.NotFound) continue;
       throw err;
     }
   }
diff --git a/src/commands/scaffold_utils.ts b/src/commands/scaffold_utils.ts
index 9d977786..8ebd859c 100644
--- a/src/commands/scaffold_utils.ts
+++ b/src/commands/scaffold_utils.ts
@@ -176,7 +176,19 @@ export function resolveInvokePrefix(): string {
   return "gambit";
 }
 
+function isPathWithinDotGambit(pathValue: string): boolean {
+  const normalized = path.normalize(path.resolve(pathValue));
+  const segments = normalized.split(/[/\\]+/).filter(Boolean);
+  return segments.includes(".gambit");
+}
+
 export async function ensureOpenRouterEnv(envPath: string): Promise<boolean> {
+  if (isPathWithinDotGambit(envPath)) {
+    throw new Error(
+      `Refusing to write OPENROUTER_API_KEY inside .gambit metadata: ${envPath}`,
+    );
+  }
+
   const envKey = Deno.env.get("OPENROUTER_API_KEY")?.trim();
   if (envKey) {
     return false;