diff --git a/.gitignore b/.gitignore
index 2c171b2c..e96ec779 100644
--- a/.gitignore
+++ b/.gitignore
@@ -18,3 +18,11 @@ pkg_ibs.sec
 # `--manifest-path pg-wasm/Cargo.toml` resolves it on its own and writes a
 # lockfile next to the manifest. The repo does not track it.
 pg-wasm/Cargo.lock
+
+# #241's JWT-rotation fixtures are committed, and `*.pem` above would otherwise
+# leave them tracked *and* ignored. release-plz refuses to run against a repo in
+# that state, which took delivery.yml's `Release-plz PR` job down (#273); the
+# `Release-plz release` job is separate and kept working, so nothing looked
+# broken. `git ls-files -ci --exclude-standard` lists what is in that state, and
+# must stay empty.
+!pg-pkg/testdata/jwt_rotation/*.pem