diff --git a/.github/workflows/debug-groq-hash.yml b/.github/workflows/debug-groq-hash.yml
new file mode 100644
index 0000000..7c1fcb9
--- /dev/null
+++ b/.github/workflows/debug-groq-hash.yml
@@ -0,0 +1,20 @@
+name: Debug — GROQ_API_KEY hash (temporary)
+
+on:
+  workflow_dispatch: {}
+
+permissions:
+  contents: read
+
+jobs:
+  hash:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Print a hash of the secret, never the value
+        env:
+          GROQ_API_KEY: ${{ secrets.GROQ_API_KEY }}
+        run: |
+          echo "length: ${#GROQ_API_KEY}"
+          echo -n "$GROQ_API_KEY" | sha256sum | cut -c1-16
+          echo -n "$GROQ_API_KEY" | head -c 8
+          echo " (prefix)"