diff --git a/.gitignore b/.gitignore
index 1f8011a..f0c7373 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1 +1,24 @@
 .session
+
+# `nix build` / `nixos-rebuild build` output symlink. Points into /nix/store and
+# churns on every build, so it must not be tracked.
+result
+result-*
+
+# git-secret. `git secret init` writes the random_seed and the `!*.secret`
+# negation; the rest is hardening.
+#
+# WARNING: `!*.secret` only un-ignores the *encrypted* blobs. It does nothing to
+# protect the plaintext originals -- that relies entirely on `git secret add`
+# appending each plaintext path below. Always run `git secret add <file>` from
+# the repo root (never hand-edit .gitsecret/paths/mapping.cfg) and verify with
+# `git status` before committing.
+.gitsecret/keys/random_seed
+# .gitsecret/keys is git-secret's GPG homedir. pubring.kbx is meant to be
+# committed; private key material and sockets never are.
+.gitsecret/keys/private-keys-v1.d/
+.gitsecret/keys/openpgp-revocs.d/
+.gitsecret/keys/*.gpg~
+.gitsecret/keys/.#*
+.gitsecret/keys/S.*
+!*.secret
diff --git a/result b/result
deleted file mode 120000
index 90987da..0000000
--- a/result
+++ /dev/null
@@ -1 +0,0 @@
-/nix/store/dgd4pa9cl1n266zsbf8xi277p304zxcw-nixos-system-t480-26.05.20260803.531670d
\ No newline at end of file