diff --git a/ansible/roles/soe/files/managed-settings.json b/ansible/roles/soe/files/managed-settings.json
index 786f9fea..60049b14 100644
--- a/ansible/roles/soe/files/managed-settings.json
+++ b/ansible/roles/soe/files/managed-settings.json
@@ -6,6 +6,7 @@
     "DISABLE_NON_ESSENTIAL_MODEL_CALLS": "1",
     "DISABLE_FEEDBACK_COMMAND": "1",
     "CLAUDE_CODE_DISABLE_FEEDBACK_SURVEY": "1",
+    "CLAUDE_CODE_GLOB_NO_IGNORE": "false",
     "DO_NOT_TRACK": "1"
   },
   "includeCoAuthoredBy": false,
diff --git a/ansible/roles/soe/tasks/claude_policy.yml b/ansible/roles/soe/tasks/claude_policy.yml
index e00d6250..76fe79fb 100644
--- a/ansible/roles/soe/tasks/claude_policy.yml
+++ b/ansible/roles/soe/tasks/claude_policy.yml
@@ -4,6 +4,7 @@
 # Applies to every user on the box and cannot be overridden by them:
 # - Disables telemetry, error reporting and the feedback prompts
 # - Disables Co-Authored-By and "Generated with Claude Code" attribution
+# - Makes the Glob tool honour .gitignore, so it skips build output and worktrees
 #
 # Split out of claude.yml so that the two carry DIFFERENT tags. The binary
 # install answers to `--tags claude`, which the developer-ai role's plugin gate