diff --git a/CHANGELOG.md b/CHANGELOG.md
index 980ef0f..b78a9d6 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -48,5 +48,4 @@
   - add acmpca-iam-rolesanywhere example
 
 * 1.2.4 -- 2025-08-01
-  - acmpca: add creation of certs/.gitignore containing *.key
-  - acmpca-iam-rolesanywhere: ignore *.crt and *.csr
+  - acmpca: add creation of certs/.gitignore containing *.key *.csr *.crt
diff --git a/acmpca-iam-rolesanywhere/README.md b/acmpca-iam-rolesanywhere/README.md
index 00b6589..bfdc644 100644
--- a/acmpca-iam-rolesanywhere/README.md
+++ b/acmpca-iam-rolesanywhere/README.md
@@ -107,7 +107,6 @@ certificate_subject = {
 | Name | Version |
 |------|---------|
 | <a name="provider_aws"></a> [aws](#provider\_aws) | >= 5.0 |
-| <a name="provider_null"></a> [null](#provider\_null) | >= 3.1.0 |
 
 ## Modules
 
@@ -119,7 +118,6 @@ certificate_subject = {
 
 | Name | Type |
 |------|------|
-| [null_resource.ignore](https://registry.terraform.io/providers/hashicorp/null/latest/docs/resources/resource) | resource |
 | [aws_arn.current](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/arn) | data source |
 | [aws_caller_identity.current](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/caller_identity) | data source |
 | [aws_region.current](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/region) | data source |
diff --git a/acmpca-iam-rolesanywhere/main.tf b/acmpca-iam-rolesanywhere/main.tf
index 852abec..988f7a3 100644
--- a/acmpca-iam-rolesanywhere/main.tf
+++ b/acmpca-iam-rolesanywhere/main.tf
@@ -130,15 +130,3 @@ module "certificate" {
     var.tags,
   )
 }
-
-resource "null_resource" "ignore" {
-  triggers = {
-    directory = dirname(module.certificate.certificate_filenames.certificate)
-  }
-  provisioner "local-exec" {
-    command = "echo '*.csr' >> ${self.triggers.directory}/.gitignore"
-  }
-  provisioner "local-exec" {
-    command = "echo '*.crt' >> ${self.triggers.directory}/.gitignore"
-  }
-}
diff --git a/acmpca/certificate.tf b/acmpca/certificate.tf
index 35c5e48..8e47dbe 100644
--- a/acmpca/certificate.tf
+++ b/acmpca/certificate.tf
@@ -89,6 +89,12 @@ resource "null_resource" "output_directory" {
   provisioner "local-exec" {
     command = "echo '*.key' >> ${local.output_file_directory}/.gitignore"
   }
+  provisioner "local-exec" {
+    command = "echo '*.crt' >> ${local.output_file_directory}/.gitignore"
+  }
+  provisioner "local-exec" {
+    command = "echo '*.csr' >> ${local.output_file_directory}/.gitignore"
+  }
 }
 
 locals {