diff --git a/.gitignore b/.gitignore
index 194db280..620d5a97 100755
--- a/.gitignore
+++ b/.gitignore
@@ -106,3 +106,7 @@ terraform.tfstate.backup
 
 # Per-feature git worktrees (worktree-first workflow — execution.md)
 .worktrees/
+
+# Timestamped terraform state backups (terraform.tfstate.<ts>.backup) — plaintext Tier-0
+# secrets; created by terraform state ops. The patterns above miss the timestamped form.
+terraform.tfstate.*.backup