diff --git a/user/.chezmoiignore b/user/.chezmoiignore
index 4104d41..7c6621d 100644
--- a/user/.chezmoiignore
+++ b/user/.chezmoiignore
@@ -80,11 +80,11 @@
 .config/teams-for-linux
 .config/yay
 
-.gnupg
+# Ignore only the keyring and runtime state that GnuPG generates itself,
+# so that the real config files can still be managed. Do not ignore
+# `.gnupg` wholesale: chezmoi never descends into an ignored directory, so
+# a `!` negation for a file inside it can never re-include that file.
 .gnupg/crls.d
-!.gnupg/dirmngr.conf
-!.gnupg/gpg-agent.conf
-!.gnupg/gpg.conf
 .gnupg/openpgp-revocs.d
 .gnupg/private-keys-v1.d
 .gnupg/public-keys.d
diff --git a/user/private_dot_gnupg/gpg-dirmngr.conf b/user/private_dot_gnupg/dirmngr.conf
similarity index 100%
rename from user/private_dot_gnupg/gpg-dirmngr.conf
rename to user/private_dot_gnupg/dirmngr.conf