diff --git a/CHANGELOG.md b/CHANGELOG.md
index cb9892f..41bc881 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -5,6 +5,10 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [main] - TBD
+- Add CACHEDIR.TAG to idf and pio temporary directories, to prevent Linux backups
+  from picking them up (see TODO, no support is added for MacOS/Windows).
+
 ## [0.33.1] - 2025-07-27
 - Fix a bug where the cmake utilities refused to work with CMake 4 due to a broken version check
 
diff --git a/src/espidf.rs b/src/espidf.rs
index a4d4444..5b2ba1f 100644
--- a/src/espidf.rs
+++ b/src/espidf.rs
@@ -658,6 +658,7 @@ impl Installer {
                 install_dir.display()
             )
         })?;
+        crate::fs::exclude_from_backups(&install_dir);
 
         let (esp_idf_dir, managed_repo) = match self.esp_idf_origin {
             EspIdfOrigin::Managed(managed) => (
diff --git a/src/fs.rs b/src/fs.rs
index 6952764..4e89acb 100644
--- a/src/fs.rs
+++ b/src/fs.rs
@@ -6,6 +6,30 @@ use std::path::Path;
 
 use anyhow::Result;
 
+/// Marks the directory as excluded from archives/backups by writing a `CACHEDIR.TAG` file.
+///
+/// This prevents derived/temporary files from bloating backups. Errors are ignored since
+/// this is an optional best-effort feature.
+///
+/// See the [Cache Directory Tagging Specification](https://bford.info/cachedir/).
+///
+/// TODO: This only replicates _part_ of what cargo_util::paths::exclude_from_backups_and_indexing does:
+/// https://doc.rust-lang.org/beta/nightly-rustc/cargo_util/paths/fn.exclude_from_backups_and_indexing.html
+/// we should consider lifting more of the code to prevent backup on MacOS, and indexing on Windows.
+pub fn exclude_from_backups(path: &Path) {
+    let file = path.join("CACHEDIR.TAG");
+    if !file.exists() {
+        let _ = std::fs::write(
+            file,
+            "Signature: 8a477f597d28d172789f06886806bc55
+# This file is a cache directory tag created by embuild.
+# For information about cache directory tags see https://bford.info/cachedir/
+",
+        );
+        // We ignore errors here as it's an optional feature.
+    }
+}
+
 /// Copy `src_file` to `dest_file_or_dir` if `src_file` is different or the destination
 /// file doesn't exist.
 ///
diff --git a/src/pio.rs b/src/pio.rs
index cf12ed0..476ea1e 100644
--- a/src/pio.rs
+++ b/src/pio.rs
@@ -243,6 +243,7 @@ impl Pio {
             if !pio_dir.exists() {
                 fs::create_dir_all(pio_dir)?;
             }
+            crate::fs::exclude_from_backups(pio_dir);
 
             pio_installer.pio(pio_dir);
         }