diff --git a/scripts/config/core/config_find_file.sh b/scripts/config/core/config_find_file.sh
index db2c719..44e1d8c 100755
--- a/scripts/config/core/config_find_file.sh
+++ b/scripts/config/core/config_find_file.sh
@@ -5,8 +5,10 @@ findConfigFileForOption()
 {
     local config_option="$1"
 
-    # Global configs first.
-    for config_file in $(find "$configs_dir" -type f -name "*" ! -name ".category"); do
+    # Global configs first. Dotfiles (reconcile backups, markers) are excluded —
+    # finding a key in a .bak before its real file would write the user's
+    # config update into the backup and silently lose it.
+    for config_file in $(find "$configs_dir" -type f ! -name ".category" ! -name ".*" ! -name "*.bak"); do
         if [ -f "$config_file" ] && grep -q "^$config_option=" "$config_file"; then
             echo "$config_file"
             return 0
diff --git a/scripts/config/core/variables/config_scan_variables.sh b/scripts/config/core/variables/config_scan_variables.sh
index f10a3d2..d5eb46a 100755
--- a/scripts/config/core/variables/config_scan_variables.sh
+++ b/scripts/config/core/variables/config_scan_variables.sh
@@ -8,8 +8,10 @@
 #     markers) from the template, so label / metadata / marker changes shipped
 #     in a release reach existing installs without nuking user values.
 # Structure, ordering and comments follow the template. Non-interactive, atomic,
-# and keeps a <file>.bak. Refuses to act on a missing/empty template so a broken
-# clone can never wipe a live config.
+# and keeps a hidden .<file>.bak sibling (dot-named so backups don't clutter the
+# configs folder and can never be picked up by the config walkers/sourcing).
+# Refuses to act on a missing/empty template so a broken clone can never wipe a
+# live config.
 
 # Split `CFG_KEY=value...#comment` into its value-part and comment-part.
 # Used by reconcileConfigFile to swap the template's comment onto the user's
@@ -87,9 +89,10 @@ reconcileConfigFile()
 
     # Replace only when the result is sane (non-empty, has keys) and differs.
     if [[ -s "$tmp" ]] && grep -q '^CFG_' "$tmp" && ! runInstallOp cmp -s "$tmp" "$live"; then
-        runCfgOp cp -a "$live" "${live}.bak"
+        local bak_file="${live%/*}/.${live##*/}.bak"
+        runCfgOp cp -a "$live" "$bak_file"
         { [[ -n "$containers_dir" && "$live" == "$containers_dir"* ]] && runFileWrite "$live" < "$tmp" || runInstallOp cp "$tmp" "$live"; }
-        isSuccessful "Reconciled config: $(basename "$live")  (backup: $(basename "$live").bak)"
+        isSuccessful "Reconciled config: $(basename "$live")  (backup: ${bak_file##*/})"
     fi
     rm -f "$tmp"
 }