diff --git a/.gitignore b/.gitignore
index 3306398..a8fbf2e 100644
--- a/.gitignore
+++ b/.gitignore
@@ -57,9 +57,14 @@ client/ios/Flutter/ephemeral/
 client/pubspec.lock
 
 # Android release 签名材料(本地或 CI 落盘,绝不入库)
-client/android/key.properties
-client/android/*.jks
-client/android/*.keystore
+# 用全局通配:签名私钥曾以 pangolin-release.jks 出现在**仓库根**,而旧规则只盖
+# client/android/ 一层,根目录那份不被忽略 → 一次 `git add -A` 就会把私钥提交进库。
+key.properties
+*.jks
+*.keystore
+*.p12
+*.mobileprovision
+*.provisionprofile
 
 # CI 客户端产物暂存目录(scripts/ci/compile-{android,windows}.sh 输出,构建期生成)
 /dist/