diff --git a/.dockerignore b/.dockerignore
index 81e3045..8897ed7 100644
--- a/.dockerignore
+++ b/.dockerignore
@@ -1,27 +1,34 @@
-# Secrets — these must never end up in an image layer.
-.env
-db.env
-*.env
-!.env.example
+# Secrets — these must never end up in an image layer. The ** prefix is
+# required: a bare ".env" would only match the context root, and the real
+# file lives in expenses_manager/.
+**/.env
+**/db.env
+!**/.env.example
 
 # Version control and IDE noise.
-.git
-.gitignore
-.vscode
-.idea
+**/.git
+**/.gitignore
+**/.vscode
+**/.idea
 
 # Local artifacts that would otherwise be copied in by COPY.
-__pycache__/
-*.py[cod]
-*.bak
-venv/
-.venv/
-db.sqlite3
-staticfiles/
-.pytest_cache/
-.coverage
-htmlcov/
+**/__pycache__/
+**/*.py[cod]
+**/*.bak
+**/venv/
+**/.venv/
+**/db.sqlite3
+**/staticfiles/
+**/.pytest_cache/
+**/.coverage
+**/htmlcov/
+**/gunicorn.ctl
+
+# CI and test configuration, not needed at runtime.
+**/Jenkinsfile
+**/pytest.ini
+**/tests/
 
 # Documentation and planning, not needed at runtime.
-*.md
+**/*.md
 LICENSE
\ No newline at end of file