diff --git a/.gitignore b/.gitignore
index b3423f2..e7adf00 100644
--- a/.gitignore
+++ b/.gitignore
@@ -2,3 +2,7 @@
 config.el
 *.qcow2
 result
+# Prevent accidentally committing unencrypted secrets
+**/secrets/*.yaml.dec
+**/*-decrypted.*
+**/temp-secrets.*