diff --git a/.dockerignore b/.dockerignore
index 6425e70abf..8b4cb63c32 100644
--- a/.dockerignore
+++ b/.dockerignore
@@ -106,3 +106,10 @@ plans/
 .gitattributes
 .hadolint.yaml
 .mailmap
+
+# Repo-root debug/export artifacts — must never reach image layers (COPY . .)
+/log.txt
+/sqlite_leak_fix.png
+/*.png.bak
+/default.tar.gz
+/*.tar.gz
diff --git a/.gitignore b/.gitignore
index a2d9f96a24..0d26c24a21 100644
--- a/.gitignore
+++ b/.gitignore
@@ -99,10 +99,10 @@ apps/desktop/src/**/*.d.ts
 !apps/desktop/src/vite-env.d.ts
 
 # Repo-root build/debug artifacts that must never be committed
-log.txt
-sqlite_leak_fix.png
-*.png.bak
-default.tar.gz
+/log.txt
+/sqlite_leak_fix.png
+/*.png.bak
+/default.tar.gz
 apps/shared/src/**/*.js
 apps/shared/src/**/*.js.map
 apps/shared/src/**/*.d.ts