diff --git a/.gitignore b/.gitignore
index dde7527..892dd7a 100644
--- a/.gitignore
+++ b/.gitignore
@@ -34,3 +34,13 @@ cfg/amar/
 cfg/dlt/
 # Add new rooms here as they are created
 # cfg/<room>/
+
+# Client rigs. A rig is a copy of rig/ renamed after the environment it models,
+# so its k8s files spell out a real architecture — exactly the thing that must
+# not land here. They are versioned in their own repo.
+#
+# Anchored at the ROOT on purpose: a copy is a SIBLING of rig/, so a rule inside
+# rig/.gitignore cannot see it. The negation must name the full path for the same
+# reason — `*-rig/` is unanchored and matches at any depth, including rig/sample-rig.
+*-rig/
+!rig/sample-rig/