diff --git a/lib/diffcrypt/tasks/rails.rake b/lib/diffcrypt/tasks/rails.rake
index db9fe26..384f858 100644
--- a/lib/diffcrypt/tasks/rails.rake
+++ b/lib/diffcrypt/tasks/rails.rake
@@ -1,5 +1,6 @@
 # frozen_string_literal: true
 
+# rubocop:disable Metrics/BlockLength
 namespace :diffcrypt do
   desc 'Initialize credentials for all environments'
   task :init, %i[environments] do |_t, args|
@@ -11,7 +12,6 @@ namespace :diffcrypt do
     environments.each do |environment|
       key_path = Rails.root.join('config', 'credentials', "#{environment}.key")
       file_path = Rails.root.join('config', 'credentials', "#{environment}.yml.enc")
-      gitignore_path = Rails.root.join('.gitignore')
       next if File.exist?(file_path) || File.exist?(key_path)
 
       # Generate a new key
@@ -26,11 +26,15 @@ namespace :diffcrypt do
         'secret_key_base' => SecureRandom.hex(32),
       }
       file.write(key, data)
+    end
 
-      # Ensure .key files are always ignored
+    # Ensure .key files are always ignored
+    gitignore_path = Rails.root.join('.gitignore')
+    unless File.read(gitignore_path).include?('config/credentials/*.key')
       ::File.open(gitignore_path, 'a') do |f|
         f.write("\nconfig/credentials/*.key")
       end
     end
   end
 end
+# rubocop:enable Metrics/BlockLength