diff --git a/.gitignore b/.gitignore
index 7ec5b55dd..67d26a651 100644
--- a/.gitignore
+++ b/.gitignore
@@ -63,3 +63,4 @@ yarn-audit-issues
 !.yarn/releases
 !.yarn/sdks
 !.yarn/versions
+app/resources/localhost-ssl/*.key
diff --git a/README.md b/README.md
index 66d20bbc9..8734a4072 100644
--- a/README.md
+++ b/README.md
@@ -47,6 +47,10 @@ The following environment variables are required:
 | ADDRESS_LOOKUP_TOKEN | Token for use with the MoJ Address Lookup service. |
 | CORS_ORIGIN_WHITELIST | Comma-separated list of authorised origins for Cross-Origin requests. `http://localhost:3451,http://localhost:3452` for the local instances of CCD |
 | APPINSIGHTS_INSTRUMENTATIONKEY | Secret for Microsoft Insights logging, can be a dummy string in local. |
+| HTTPS_CERT_PATH | Optional path to a locally generated HTTPS certificate. Used with `HTTPS_KEY_PATH` when `ENV=localdev`. |
+| HTTPS_KEY_PATH | Optional path to the matching locally generated HTTPS private key. Never commit the key to the repository. |
+
+For local development, the gateway uses HTTP by default. To enable HTTPS, set `ENV=localdev` and provide both `HTTPS_CERT_PATH` and `HTTPS_KEY_PATH` pointing to files generated outside the repository. Both variables must be set together.
 
 **Note:** To support large document uploads via the api gateway, the maximum allowed length for request content is 
 configured via *maxAllowedContentLength* property for request filter in **web.config** (config file within source repository). 
diff --git a/app/resources/localhost-ssl/localhost.key b/app/resources/localhost-ssl/localhost.key
deleted file mode 100644
index fa55ed859..000000000
--- a/app/resources/localhost-ssl/localhost.key
+++ /dev/null
@@ -1,27 +0,0 @@
------BEGIN RSA PRIVATE KEY-----
-MIIEpAIBAAKCAQEA0CbBsbjLNWtLYlZsmiYIOLsYVV3qEZCWo95RZl+kgaSjkMSt
-lDkKCjFE+Gzb8OaMj1QXUW1NZlR+sOL8IBlFNjx0+JWKbrQfGxnklcETcW5sRKuc
-0kqslbbjN3aPf76G1sC+oW6qOK7sIZyOOnA6tBN9ySqr3G7bxXOiZMyxep+IH4t7
-Wb5cas6Rb/Qvfq5JAn0V/YUesylH/nGvPq4I4KXdCQufWvgPCm0wrwy+8EEpMSlW
-YirPSUV6fZEJYH9PUUhlJ/gFR9IP5Dk1v0GOzFQz6pr9+1NBZRu+KT2YuTGe1Ygc
-O0NejqEXkFat+HEyMqVdeCj1j7ofQLyB+Iz2JQIDAQABAoIBAQC4fiGgTJKQvpEK
-kF+iIaOX5P0kbSFSgD2E8UBk5NECt9LiNfFEN2pWrmTbbGFlnHNpdrdUTPUVhj7k
-ucuPB9b4w41J6AHTLYOEmeapdYCuQZllJFbTbaya5oduWX/HUjBhmGVe4J+vrhtN
-j13hHihqA/yxmUjLENdqo5uEjImijLpfyXpp1Uq5V2pkD+zVBW5p1qpjsLBqBcif
-66yObvBwUGvuZ6VwXBXnZ+5cIsoizBZENwKe7EpGA0i4fO87yLr3CP17tXqdtY/K
-4ztNrGyzItcmL/lEehj5n7xI+rdzfWaJWgKHVDvawuxBBF8VGJEKpBOHCbBaIGnu
-YfwESi8BAoGBAPPTiwg3eAekr01N0sAWquZi/shHdAhENcCuwX/sMlxkCHeA2r1O
-U+vL4DD6juvZMB9EwQaI1Bs9E5LSH3TyJpcq7JQ/7yBYRyoLAaJV9IJqxZA7IY/K
-uNAgioBYWQuimTRl97FCdR7568hrK8x4xw4uRdguibWhsrK/Ipu5TwTpAoGBANqL
-PE5hs/7A0v03amCusXfr32HeI+WOMmE+dsRX979jQuioS08HPXo1JZCpzblmA7T9
-BoO4jfsUfbZ4QtSYaHwSvQjWmtRr5IgiQYa3Ah3553D7R8qLDrsUTC65EESJnfo3
-/zaJ/7MfPOBHwHCikgiAqo4omUI9bI7RBIFriFHdAoGAVNCYQ1JwOVBq/lv83H7G
-EgALmoVocluvywe/HY1+8y6E13UGIeW2QYaYxNDTmGzjVW0oK+q6xYLYZTEcaiS1
-kc4Hn4Yh20F598D+X4bA2ADmGkbHZOpioVtAcmbJCsgTvOtfXtS8QvsyrnPBN44n
-x+IGv61oj7rgm1brZfnu58kCgYApTMDDy0D5trTot206Ail1kTSwyQsdmYa5y9Uj
-+7/NAlQlpZA9yg97JcoIkZ5YGAhBTsPJZromJdQwBIAUrwynzd69adjupckVVOvv
-KmyS/6QWPNZvV2IcRpSzC7QgT6V0INrxEpko35FgjQ63+nEAfFg+7zsvQm5eeu+Q
-CaNEXQKBgQCnVV4hLs8aZNiAMOfLxpcshCP9346OyPIh+VzYqjknVfI50g8WwxOl
-AjrUlCYwQ6PxAYvPKSFmxK1b/sPzM5g/DMwbkgqxtEoFYq6wo7sOSmjF8Sa58OJo
-JMLPqAfUPXqL5ailaHijyqvTS71O84rBLpFuiSqVv5igUzzs80MYgA==
------END RSA PRIVATE KEY-----
diff --git a/docs/skills/CCD_7877_Hardcoded_Credentials/SKILL.md b/docs/skills/CCD_7877_Hardcoded_Credentials/SKILL.md
new file mode 100644
index 000000000..977068293
--- /dev/null
+++ b/docs/skills/CCD_7877_Hardcoded_Credentials/SKILL.md
@@ -0,0 +1,40 @@
+# CCD-7877 Hardcoded Credentials
+
+## Objective
+
+Remove the tracked private key and externalise runtime credentials while preserving safe local development.
+
+## Acceptance criteria
+
+- No private key is tracked.
+- Runtime credentials use environment or managed-secret injection.
+- Local HTTPS uses ignored, locally managed certificate files.
+- No live credential rotation is performed by this change.
+
+## Validation
+
+- Node syntax and Compose interpolation checks passed.
+- Full Docker runtime validation remains outstanding.
+
+## Scope and findings
+
+Remediation status: the tracked key has now been removed from this branch. Local HTTPS uses `HTTPS_CERT_PATH` and `HTTPS_KEY_PATH`; no live credential rotation was performed.
+
+- `app/resources/localhost-ssl/localhost.key` is a tracked PEM RSA private key, added in history on 2018-03-17 during open sourcing.
+- `server.js` reads externally supplied certificate and key paths for local HTTPS; it no longer reads bundled key material.
+- Existing secret-to-environment mappings include `IDAM_OAUTH2_CLIENT_SECRET`, `ADDRESS_LOOKUP_TOKEN`, `IDAM_SERVICE_KEY`, and `APPINSIGHTS_INSTRUMENTATIONKEY`.
+- Prior history includes secret-removal work, but not evidence of private-key rotation.
+
+## Validity and deployment
+
+- Current validity: **not confirmed**; no live authentication or secret-store access was available.
+- Deployment/runtime: repository evidence only; Helm/Terraform and environment-backed configuration exist, but live pods, CI variables, and cloud secret stores were not accessible.
+- Rotation: **not confirmed** for the key or reported credentials.
+
+## Recommendations
+
+Treat the key and reported credentials as compromised. Revoke/rotate through the owning systems, remove the key from source and history, and use runtime-mounted secrets or managed TLS. Continue using the existing environment variables; if a runtime key is required, use `HTTPS_KEY_PATH` and `HTTPS_CERT_PATH`. Verify live secret-store references, deployed pods, CI/CD variables, and rotation records before closure.
+
+## Local operation
+
+Local HTTPS is now externalised. When running standalone, provide `HTTPS_CERT_PATH` and `HTTPS_KEY_PATH` to locally managed files. When using the CCD Docker stack, run `ccd-docker/bin/setup-local-secrets.sh`; it creates ignored local values and certificate files for the stack. No approved fixed-defaults-file fallback is currently implemented.
diff --git a/server.js b/server.js
index fec709390..49194a7c3 100644
--- a/server.js
+++ b/server.js
@@ -9,7 +9,6 @@ let app = require('./app');
 let debug = require('debug')('ccd-api-gateway-web:server');
 let http = require('http');
 let https = require('https');
-let path = require('path');
 let fs = require('fs');
 
 /**
@@ -28,10 +27,17 @@ let server = createServer(app);
 
 function createServer(app) {
   if (process.env.ENV === 'localdev') {
-    const sslDirectory = path.join(__dirname, '..', 'app', 'resources', 'localhost-ssl');
+    const certificatePath = process.env.HTTPS_CERT_PATH;
+    const keyPath = process.env.HTTPS_KEY_PATH;
+    if (!certificatePath && !keyPath) {
+      return http.createServer(app);
+    }
+    if (!certificatePath || !keyPath) {
+      throw new Error('HTTPS_CERT_PATH and HTTPS_KEY_PATH must both be set for local HTTPS');
+    }
     const sslOptions = {
-      cert: fs.readFileSync(path.join(sslDirectory, 'localhost.crt')),
-      key: fs.readFileSync(path.join(sslDirectory, 'localhost.key')),
+      cert: fs.readFileSync(certificatePath),
+      key: fs.readFileSync(keyPath),
       secureProtocol: 'TLS_method'
     };
     return https.createServer(sslOptions, app);