diff --git a/crates/settings/src/settings_content/project.rs b/crates/settings/src/settings_content/project.rs
index c76321d3a9ec662dde65d1cc33848217378bcb19..fd4f34ff4fc647c389ab977b1076003516cb7421 100644
--- a/crates/settings/src/settings_content/project.rs
+++ b/crates/settings/src/settings_content/project.rs
@@ -80,7 +80,7 @@ pub struct WorktreeSettingsContent {
     pub file_scan_inclusions: Option<Vec<String>>,
 
     /// Treat the files matching these globs as `.env` files.
-    /// Default: [ "**/.env*" ]
+    /// Default: ["**/.env*", "**/*.pem", "**/*.key", "**/*.cert", "**/*.crt", "**/secrets.yml"]
     pub private_files: Option<Vec<String>>,
 }
 
diff --git a/crates/worktree/src/worktree_settings.rs b/crates/worktree/src/worktree_settings.rs
index 92f1d7220c3984bea98f439dfca51890c2d2e473..5093988ac2ac66682aba9447a6347ecfc54ecf76 100644
--- a/crates/worktree/src/worktree_settings.rs
+++ b/crates/worktree/src/worktree_settings.rs
@@ -66,11 +66,11 @@ impl Settings for WorktreeSettings {
             self.project_name = Some(project_name);
         }
 
-        // todo!() test this. Did it used to extend the arrays, or overwrite them?
-
-        if let Some(private_files) = worktree.private_files.clone() {
+        if let Some(mut private_files) = worktree.private_files.clone() {
+            let sources = self.private_files.sources();
+            private_files.extend_from_slice(sources);
             if let Some(matchers) = path_matchers(private_files, "private_files").log_err() {
-                self.private_files = matchers
+                self.private_files = matchers;
             }
         }