diff --git a/.gitignore b/.gitignore
new file mode 100644
index 0000000..8d1f485
--- /dev/null
+++ b/.gitignore
@@ -0,0 +1,32 @@
+# The repository is checked out over $HOME with a bare repo and
+# status.showUntrackedFiles=no, so this list is not there to quieten
+# "git status" - it is a guard against an absent-minded "config add".
+#
+# It does not stop "config add -f". Nothing here protects against intent, only
+# against carelessness.
+
+# Secrets - never in the repository.
+# mailsecrets.py is the existing pattern: .config/waybar/modules/mail.py
+# imports its IMAP credentials from it and the file has never been committed.
+mailsecrets.py
+.netrc
+.pgpass
+*.key
+*.pem
+id_*
+!id_*.pub
+
+# Machine-local - these must differ per machine, so a shared version would
+# overwrite the very thing that distinguishes them.
+.config/dotconfs/role
+.config/zsh/rc.d/90-local.zsh
+
+# Left behind by the rollout on purpose, as a way back.
+.zshrc.pre-dotconfs
+.config-backup/
+
+# Runtime state and caches.
+.zsh_history
+.zcompdump*
+.cache/
+.p10k-instant-prompt-*.zsh