diff --git a/.dockerignore b/.dockerignore
index 4f7fa2b..2db6769 100644
--- a/.dockerignore
+++ b/.dockerignore
@@ -73,9 +73,12 @@
 
 # This repository's own entries, after the shared content above: the
 # frontend build, the viewport test's output, the binary `make build`
-# writes and the reports `make run` stores, and log files at the root.
+# writes and the reports `make run` stores, and Go test binaries,
+# coverage output and log files at the root.
 /dist
 /tmp
 /netwatch-server
 /data
+/*.test
+/*.out
 /*.log
diff --git a/TODO.md b/TODO.md
index afb5101..02ddbb6 100644
--- a/TODO.md
+++ b/TODO.md
@@ -22,6 +22,14 @@ Run `make frontend-viewport-test` in CI as its own step; it is not part of
 
 # Completed Steps
 
+- 2026-10-19: `.dockerignore` keeps Go test binaries and coverage output at the
+  root out of the build context, with `/*.test` and `/*.out` in the repository's
+  own section ([#155](https://git.eeqj.de/sneak/netwatch/issues/155)). Such
+  files went into the build context of every `docker build` in `script/` and
+  were copied into the lint, test and build stages. Checked with a probe image
+  that copies the whole context: `x.test` and `x.out` planted at the root no
+  longer land in it, and nothing else changed. The entries match only at the
+  root, so the same files in a subdirectory still reach the image
 - 2026-10-19: `.gitea/workflows/check.yml` is the sneak/prompts copy at
   `0653579` ([#153](https://git.eeqj.de/sneak/netwatch/issues/153)). Its
   checkout step sets `fetch-depth: 0`, so CI clones all history and tags, and