diff --git a/app/Controllers/Setup.php b/app/Controllers/Setup.php
index 617cdd9..06fe8a7 100644
--- a/app/Controllers/Setup.php
+++ b/app/Controllers/Setup.php
@@ -259,6 +259,26 @@ class Setup extends BaseController
             $tables = $this->db->listTables();
             $exportedAllTables = true;
         }
+        // Tables that must never be exported in all-tables mode:
+        // audit trails, session logs, queue tables, and CI framework internals
+        // can contain secret values (API keys set via admin UI) or sensitive data.
+        $neverExport = [
+            'clinical_audit_trail',
+            'lab_log',
+            'bridge_sync_queue',
+            'ci_sessions',
+            'sessions',
+            'auth_token_logins',
+            'auth_logins',
+            'auth_remember_tokens',
+            'patient_duplicate_log',
+        ];
+
+        if ($exportedAllTables) {
+            $tables = array_values(array_filter($tables, static function ($t) use ($neverExport): bool {
+                return ! in_array(strtolower((string) $t), $neverExport, true);
+            }));
+        }
 
         $seedPayload = [
             'generated_at' => date('Y-m-d H:i:s'),
diff --git a/app/Database/master_seed_data.json b/app/Database/master_seed_data.json
index 1386505..758670b 100644
--- a/app/Database/master_seed_data.json
+++ b/app/Database/master_seed_data.json
@@ -1575,7 +1575,7 @@
                 "record_id": "GEMINI_API_KEY",
                 "field_name": "GEMINI_API_KEY",
                 "old_value": "\"\"",
-                "new_value": "\"AIzaSyBSHpC1N7drS721o7KRZiMWygPK4CopNQI\"",
+                "new_value": "\"REDACTED_GEMINI_API_KEY\"",
                 "user_id": "1",
                 "action_at": "2026-02-21 19:34:24",
                 "hash": "dfc6370231d5fec4c562914546b5aea6fa79e1a8fe86d84ba9ba31c121cdcfcb",