diff --git a/.gitignore b/.gitignore
index 060d1a4..55336db 100644
--- a/.gitignore
+++ b/.gitignore
@@ -13,6 +13,8 @@ secrets/vault-pass.txt
 
 # Placeholder marker generated when password archive is absent
 secrets/vault-pass.txt.zip.PLACEHOLDER
+# Plaintext vault dumps must never be committed
+secrets/*.text
 # Local installer env overrides with real secrets
 install.local.env
 *.secret.env