diff --git a/lib/index.js b/lib/index.js
index 28e8d98..8445925 100644
--- a/lib/index.js
+++ b/lib/index.js
@@ -298,6 +298,7 @@ class PackWalker extends IgnoreWalker {
       '!/package.json',
       '/.git',
       '/node_modules',
+      '.npmrc',
       '/package-lock.json',
       '/yarn.lock',
       '/pnpm-lock.yaml',
diff --git a/test/ignore-file-included-by-globstar.js b/test/ignore-file-included-by-globstar.js
index c031c2b..7eff576 100644
--- a/test/ignore-file-included-by-globstar.js
+++ b/test/ignore-file-included-by-globstar.js
@@ -4,9 +4,45 @@ const Arborist = require('@npmcli/arborist')
 const t = require('tap')
 const packlist = require('../')
 
+t.test('exclude certain files always', async t => {
+  const path = t.testdir({
+    '.npmrc': 'secrets=true',
+    '.git': {
+      HEAD: 'empty',
+    },
+    node_modules: {
+      foo: {
+        'index.js': '',
+      },
+    },
+    subdir: {
+      'other.js': '',
+      '.npmrc': 'sneaky=true',
+    },
+    'index.js': '',
+    'glorp.txt': '',
+    'package.json': JSON.stringify({
+      name: '@npmcli/globstar-test',
+      version: '1.0.0',
+      files: ['*'],
+    }),
+    'package-lock.json': '{}',
+    'yarn.lock': '{}',
+    'pnpm-lock.yaml': '{}',
+  })
+  const arborist = new Arborist({ path })
+  const tree = await arborist.loadActual()
+  const files = await packlist(tree)
+  t.same(files, [
+    'index.js',
+    'subdir/other.js',
+    'package.json',
+    'glorp.txt',
+  ])
+})
+
 t.test('include a globstar, then exclude one of them', async (t) => {
   const path = t.testdir({
-    'foo.js': '',
     'bar.js': '',
     bar: {
       'bar.js': '',