diff --git a/crates/service/obs_gateway/src/main.rs b/crates/service/obs_gateway/src/main.rs
index 69e3c2209f..22bac536f7 100644
--- a/crates/service/obs_gateway/src/main.rs
+++ b/crates/service/obs_gateway/src/main.rs
@@ -77,7 +77,7 @@ async fn main() -> AnyhowResult<()> {
 
   info!("Reading Twitch secrets...");
 
-  let secrets = TwitchSecrets::from_file("twitch_secrets.toml")?;
+  let secrets = TwitchSecrets::from_env()?;
   let client_id = ClientId::new(&secrets.app_client_id);
   let client_secret = ClientSecret::new(&secrets.app_client_secret);
 
diff --git a/crates/service/obs_gateway/src/twitch/twitch_secrets.rs b/crates/service/obs_gateway/src/twitch/twitch_secrets.rs
index 2cb6c72e55..ac828ff86d 100644
--- a/crates/service/obs_gateway/src/twitch/twitch_secrets.rs
+++ b/crates/service/obs_gateway/src/twitch/twitch_secrets.rs
@@ -1,25 +1,17 @@
 use container_common::anyhow_result::AnyhowResult;
 
-// TODO: Not sure I need all of these. The less I need to keep, the better.
-//  Oauth delegation in particular seems not necessary.
 #[derive(Clone, serde::Deserialize)]
 pub struct TwitchSecrets {
-  pub username: String,
-  pub stream_key: String,
   pub app_client_id: String,
   pub app_client_secret: String,
 }
 
 impl TwitchSecrets {
   pub fn new(
-    username: &str,
-    stream_key: &str,
     app_client_id: &str,
     app_client_secret: &str,
   ) -> Self {
     Self {
-      username: username.to_string(),
-      stream_key: stream_key.to_string(),
       app_client_id: app_client_id.to_string(),
       app_client_secret: app_client_secret.to_string(),
     }
@@ -27,8 +19,6 @@ impl TwitchSecrets {
 
   pub fn from_env() -> AnyhowResult<Self> {
     Ok(Self::new(
-      &easyenv::get_env_string_required("TWITCH_USERNAME")?,
-      &easyenv::get_env_string_required("TWITCH_STREAM_KEY")?,
       &easyenv::get_env_string_required("TWITCH_APP_CLIENT_ID")?,
       &easyenv::get_env_string_required("TWITCH_APP_CLIENT_SECRET")?,
     ))
diff --git a/crates/service/obs_gateway/src/twitch/twitch_user_id.rs b/crates/service/obs_gateway/src/twitch/twitch_user_id.rs
index a6a5022899..ae1b83aa41 100644
--- a/crates/service/obs_gateway/src/twitch/twitch_user_id.rs
+++ b/crates/service/obs_gateway/src/twitch/twitch_user_id.rs
@@ -1,7 +1,7 @@
 use container_common::anyhow_result::AnyhowResult;
 
-/// Twitch says to encode these as strings, but the Twitch libraries
-/// still deal in integers. This centralizes type juggling.
+/// Twitch says to encode these as strings, but the Twitch Rust libraries
+/// still deal in integers (uh oh). This centralizes type juggling.
 #[derive(Clone)]
 pub struct TwitchUserId {
   string_user_id: String,
diff --git a/crates/service/obs_gateway/src/twitch_pubsub_job.rs b/crates/service/obs_gateway/src/twitch_pubsub_job.rs
index 325ec9f36f..cd4bf47274 100644
--- a/crates/service/obs_gateway/src/twitch_pubsub_job.rs
+++ b/crates/service/obs_gateway/src/twitch_pubsub_job.rs
@@ -41,6 +41,10 @@ use twitch_oauth2::{ClientId, ClientSecret, RefreshToken, AccessToken};
 pub async fn main() -> AnyhowResult<()> {
   easyenv::init_all_with_default_logging(Some(DEFAULT_RUST_LOG));
 
+  // NB: Do not check this secrets-containing dotenv file into VCS.
+  // This file should only contain *development* secrets, never production.
+  let _ = dotenv::from_filename(".env-secrets").ok();
+
   let server_hostname = hostname::get()
       .ok()
       .and_then(|h| h.into_string().ok())
@@ -48,7 +52,7 @@ pub async fn main() -> AnyhowResult<()> {
 
   info!("Reading Twitch secrets...");
 
-  let secrets = TwitchSecrets::from_file("twitch_secrets.toml")?;
+  let secrets = TwitchSecrets::from_env()?;
   let client_id = ClientId::new(&secrets.app_client_id);
   let client_secret = ClientSecret::new(&secrets.app_client_secret);