diff --git a/drb-c2-core/app/internal/logger.py b/drb-c2-core/app/internal/logger.py
index 13ead5c..76c9d37 100644
--- a/drb-c2-core/app/internal/logger.py
+++ b/drb-c2-core/app/internal/logger.py
@@ -7,4 +7,12 @@ logging.basicConfig(
     handlers=[logging.StreamHandler(sys.stdout)],
 )
 
+# httpx logs every request at INFO as a full URL *including the query string*,
+# which puts API keys in plaintext in container logs — the Google Maps key was
+# leaking on every geocode call (`?address=...&key=AIza...`). Nothing here needs
+# per-request client logging, so drop httpx to WARNING; failures still surface
+# because the callers log their own errors.
+logging.getLogger("httpx").setLevel(logging.WARNING)
+logging.getLogger("httpcore").setLevel(logging.WARNING)
+
 logger = logging.getLogger("drb-c2-core")