diff --git a/.dockerignore b/.dockerignore
index 3348f55..fa58749 100644
--- a/.dockerignore
+++ b/.dockerignore
@@ -8,3 +8,8 @@ test
 .github
 docker-compose.yml
 config/timeframe.yml
+# Local runtime state and personal compose settings (may hold the database,
+# SECRET_KEY_BASE and a Home Assistant token) must never enter the image.
+data
+pgdata
+docker-compose.override.yml
diff --git a/.gitignore b/.gitignore
index 46292b7..49a6743 100644
--- a/.gitignore
+++ b/.gitignore
@@ -20,3 +20,7 @@ test_full_output.txt
 engine/test/dummy/tmp/
 # Capybara/system test screenshots
 tmp/screenshots/
+# Local Docker state: a ./data bind mount holds the database and the
+# SECRET_KEY_BASE file; the override file holds personal settings/tokens.
+/data/
+docker-compose.override.yml