diff --git a/.gitignore b/.gitignore
index e28bd68..433a8ee 100644
--- a/.gitignore
+++ b/.gitignore
@@ -41,3 +41,8 @@ secrets.*
 
 # CI artifact
 sbom.json
+
+# Blog drafts are PRIVATE staging - this repo is public and anonymously readable.
+# Nothing under drafts/ may ever be committed; a draft becomes public only by
+# being moved into src/content/blog/ at publish time.
+drafts/