diff --git a/.github/workflows/test-hosted-runners.yml b/.github/workflows/test-hosted-runners.yml
index 0371537..0d31739 100644
--- a/.github/workflows/test-hosted-runners.yml
+++ b/.github/workflows/test-hosted-runners.yml
@@ -44,8 +44,14 @@ jobs:
       run: tar -xf artifact2/artifact.tar -C artifact2 && rm artifact2/artifact.tar
       shell: bash
 
+    - name: Check for absence of hidden files
+      run: if [ $(find artifact2 -regex ".*/\..*" | wc -l) != 0 ]; then echo "Hidden files found"; exit 1; fi
+      shell: bash
+
     - name: Compare files
-      run: diff -qr artifact artifact2
+      run: |
+        rm artifact/.hidden
+        diff -qr artifact artifact2
       shell: bash
 
     - name: Check for absence of symlinks
diff --git a/action.yml b/action.yml
index a19976e..f2c7662 100644
--- a/action.yml
+++ b/action.yml
@@ -32,6 +32,7 @@ runs:
           -cvf "$RUNNER_TEMP/artifact.tar" \
           --exclude=.git \
           --exclude=.github \
+          --exclude=".[^/]*" \
           .
         echo ::endgroup::
       env:
@@ -49,6 +50,7 @@ runs:
           -cvf "$RUNNER_TEMP/artifact.tar" \
           --exclude=.git \
           --exclude=.github \
+          --exclude=".[^/]*" \
           .
         echo ::endgroup::
       env:
@@ -66,6 +68,7 @@ runs:
           -cvf "$RUNNER_TEMP\artifact.tar" \
           --exclude=.git \
           --exclude=.github \
+          --exclude=".[^/]*" \
           --force-local \
           "."
         echo ::endgroup::
diff --git a/script/new-artifact.sh b/script/new-artifact.sh
index 136e632..102d41a 100755
--- a/script/new-artifact.sh
+++ b/script/new-artifact.sh
@@ -8,3 +8,6 @@ echo 'world' > subdir/world.txt
 # Add some symlinks (which we should dereference properly when archiving)
 ln -s subdir subdir-link
 ln -s hello.txt bonjour.txt
+
+# Create some hidden files
+echo 'foo' > .hidden