diff --git a/nixos/.gitignore b/nixos/.gitignore
new file mode 100644
index 0000000..0431210
--- /dev/null
+++ b/nixos/.gitignore
@@ -0,0 +1,4 @@
+# Host private keys staged for an install (see README); never commit
+/extra/
+result
+result-*