diff --git a/tools/nixery/.gitignore b/tools/nixery/.gitignore
index 1e5c28c01..4203fee19 100644
--- a/tools/nixery/.gitignore
+++ b/tools/nixery/.gitignore
@@ -1,3 +1,9 @@
 result
 result-*
 .envrc
+debug/
+
+# Just to be sure, since we're occasionally handling test keys:
+*.pem
+*.p12
+*.json