diff --git a/crates/tinysecurity-policy/src/floor_tests.rs b/crates/tinysecurity-policy/src/floor_tests.rs
index 6ed04c47..91735855 100644
--- a/crates/tinysecurity-policy/src/floor_tests.rs
+++ b/crates/tinysecurity-policy/src/floor_tests.rs
@@ -164,7 +164,15 @@ fn every_vocabulary_entry_is_recognised_by_the_floor() {
 #[test]
 fn vocabulary_splits_directories_from_files_and_keeps_every_constant() {
     let vocabulary = floor_vocabulary();
-    for name in [".ssh", ".gnupg", ".aws", ".azure", ".kube", "keychains"] {
+    for name in [
+        ".ssh",
+        ".gnupg",
+        ".aws",
+        ".azure",
+        ".oci",
+        ".kube",
+        "keychains",
+    ] {
         assert!(vocabulary.components.iter().any(|c| c == name), "{name}");
     }
     for name in [".netrc", ".git-credentials", ".pgpass", ".npmrc"] {
diff --git a/crates/tinysecurity-policy/src/path.rs b/crates/tinysecurity-policy/src/path.rs
index 729beb07..c6d1d1b0 100644
--- a/crates/tinysecurity-policy/src/path.rs
+++ b/crates/tinysecurity-policy/src/path.rs
@@ -19,6 +19,7 @@ pub(super) const CREDENTIAL_COMPONENTS: &[&str] = &[
     ".gnupg",
     ".aws",
     ".azure",
+    ".oci",
     ".kube",
     "keychains",
     ".netrc",
diff --git a/crates/tinysecurity-policy/src/path_scope_host_port_tests.rs b/crates/tinysecurity-policy/src/path_scope_host_port_tests.rs
index 5d60badc..a9574a55 100644
--- a/crates/tinysecurity-policy/src/path_scope_host_port_tests.rs
+++ b/crates/tinysecurity-policy/src/path_scope_host_port_tests.rs
@@ -119,6 +119,9 @@ fn sensitive_files_and_directories_are_refused_case_insensitively() {
         "/home/u/.AWS/credentials",
         "/home/u/.kube/config",
         "/home/u/.azure/x",
+        "/home/u/.oci/config",
+        "/home/u/.OCI/oci_api_key.pem",
+        "C:\\Users\\u\\.oci\\oci_api_key.pem",
         "/home/u/.docker/config.json",
         "/home/u/.cargo/credentials.toml",
         "/Users/u/Library/Keychains/login.keychain-db",