diff --git a/.gitignore b/.gitignore
index 364b8ecf03..961bad2564 100644
--- a/.gitignore
+++ b/.gitignore
@@ -74,3 +74,20 @@ sources/x86_64-unknown-redox/
 sources/*.tar.gz
 Packages/*.pkgar
 .slim/deepwork/
+
+# Bare git fetcher caches at the repo root. The cookbook's fetch workflow
+# creates these as transient scratch space (shallow clones used during
+# recipe source acquisition). Not declared submodules — see .gitmodules
+# for the canonical 9 `submodule/<component>` entries. Anchored to root
+# only; does NOT match nested `.git` directories inside submodules.
+/*.git/
+
+# Empty placeholder file at the repo root. Was an artifact of a reverted
+# "phase 1.1: refresh gitlink SHAs for 9 submodules" attempt — see commit
+# b062cf43b7. The real relibc lives at local/sources/relibc/ (a submodule).
+/relibc
+
+# Downloaded toolchain installer tarballs under prefix/. Reproducible
+# from build-redbear.sh — never commit them. The toolchain is rebuilt by
+# `make prefix` after fork (relibc/kernel/base) changes.
+/prefix/**/*.tar.gz