diff --git a/deploy/nginx.conf b/deploy/nginx.conf
index e8f46bb..dfcafd7 100644
--- a/deploy/nginx.conf
+++ b/deploy/nginx.conf
@@ -7,6 +7,12 @@ server {
 
     charset utf-8;
 
+    # Deny access to repo metadata, deploy scripts/configs, and dotfiles
+    location ~ /\.git { deny all; return 404; }
+    location ~ /\.    { deny all; return 404; }
+    location ^~ /deploy/   { deny all; return 404; }
+    location = /deploy-pull.sh { deny all; return 404; }
+
     location = / {
         try_files /facere.html =404;
     }