diff --git a/CHANGELOG.md b/CHANGELOG.md
index 51c149dcca5..84a8cfdebaa 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -30,6 +30,7 @@ This serves two purposes:
 - Pages with non-HTML output paths are now excluded from automatic navigation by default. Explicit navigation front matter now takes precedence over automatic navigation exclusions.
 - Fenced code blocks are now rendered through the publishable `components/markdown/code-block.blade.php` view, which changes the generated markup around the code. Syntax highlighting is unaffected, and the `hyde-code-block` and `hyde-code-block-label` classes are stable hooks for your own CSS.
 - Code block labels are now set with a `title="…"` modifier on the fence, replacing the `// filepath:` comment syntax, which is no longer recognized and must be replaced.
+- The `_media` directory is now a passthrough: files are published to the built site regardless of file type, not just those with a recognized extension. Review `_media` before upgrading, as anything stored there is now public.
 
 ### Deprecated
 - for changes that will be removed in upcoming releases.
@@ -38,6 +39,7 @@ This serves two purposes:
 - Removed the `rebuild` command. It had no remaining internal consumers now that the realtime compiler renders pages in-memory, and single-page builds can silently leave aggregate outputs (sitemap, RSS, search index, navigation) stale. Use `Hyde\Framework\Actions\StaticPageBuilder::handle()` instead if you need to build a single page programmatically.
 - Removed the `InMemoryPage` instance macro API. Use a contents closure for dynamic output, or extend `InMemoryPage` to add custom methods and behavior.
 - Removed the `components/filepath-label.blade.php` view, as the label markup now lives in the code block view. If this was published, port any customizations into `components/markdown/code-block.blade.php`.
+- Removed the `hyde.media_extensions` config option and the `MediaFile::EXTENSIONS` constant, now that the media directory discovers files of every type.
 
 ### Fixed
 - Fixed Markdown-to-plain-text conversion consuming unrelated content after ATX headings and stripping literal trailing hashes in https://github.com/hydephp/develop/pull/2590
diff --git a/HYDEPHP_V3_PLANNING.md b/HYDEPHP_V3_PLANNING.md
index eed8207afc1..de67eab4e25 100644
--- a/HYDEPHP_V3_PLANNING.md
+++ b/HYDEPHP_V3_PLANNING.md
@@ -74,6 +74,8 @@ Having this document in code lets us know the devlopment state at any given poin
 
   The undocumented `hyde.empty_output_directory` option is removed too. It was never present in the shipped `config/hyde.php` and never documented, so no upgrade step is needed for it.
 
+- The `_media` directory is now a passthrough for every file it contains, rather than only files matching the `hyde.media_extensions` allow-list. That option is removed, along with `MediaFile::EXTENSIONS`, with no deprecated compatibility constant. `Thumbs.db` and `desktop.ini` are still skipped regardless of case, since Symfony Finder's dotfile and VCS exclusions were already relied on and remain unchanged. This lets media types Hyde never had an opinion about — PDFs, fonts, archives — pass through without a config change, at the cost of also copying files a project may have parked in `_media` for other reasons. The publication rule lives in `MediaFile::isPublishable()`, which the build, `hyde serve`, and `Hyde::asset()` all use, so the preview server no longer serves `_media` files the build skips, such as `Thumbs.db` or dotfiles, and `Hyde::asset()` refuses to link to them.
+
 ### Upgrade guide
 
 Please fill in UPGRADE.md as you make changes.
@@ -92,6 +94,7 @@ Please fill in UPGRADE.md as you make changes.
 - Compare a few pages against your old site if you have custom CSS for code blocks or their labels, since the generated markup changed. The `hyde-code-block` and `hyde-code-block-label` classes are stable hooks to target instead of the markup structure.
 - Port any customizations from a published `filepath-label.blade.php` to `markdown/code-block.blade.php`. The old file is ignored after upgrading, so the site renders with the shipped label until they are moved.
 - Move manually maintained files out of the output directory and into `_static`, since the whole output directory is now emptied before every build. Remove `safe_output_directories` from a published `config/hyde.php`.
+- Remove `media_extensions` from a published `config/hyde.php` before updating Composer dependencies, since it references the removed `MediaFile::EXTENSIONS` constant, and move any non-asset files out of `_media` that you were relying on the extension allow-list to keep out of the build.
 
 ## `InMemoryPage` content-source motivation
 
diff --git a/UPGRADE.md b/UPGRADE.md
index d81d138ffe6..8ca84170d74 100644
--- a/UPGRADE.md
+++ b/UPGRADE.md
@@ -47,6 +47,8 @@ git commit -m "Pre-upgrade backup before HydePHP v3.0"
 
 //
 
+>warning If your published `config/hyde.php` has a `media_extensions` entry, delete it **before** updating your Composer dependencies. The entry references the removed `MediaFile::EXTENSIONS` constant, so the application fails to load, including during `composer update`, until it is gone. Files in `_media` are no longer filtered by extension, so the option has no replacement. See [Step 13](#step-13-review-the-contents-of-your-media-directory).
+
 ### Update Node Dependencies
 
 HydePHP v3 upgrades the bundled `vite` dependency from v7 to v8. Update your `package.json` `devDependencies` to require the new major version:
@@ -439,10 +441,17 @@ Move those files into the `_static` directory, which is copied verbatim to the s
 
 The `hyde.safe_output_directories` option no longer exists, and the build no longer asks for confirmation before emptying an unfamiliar output directory. Delete the entry from your `config/hyde.php`. Take the chance to double-check your `hyde.output_directory` if you build somewhere other than `_site`, since everything in that directory is now removed on every build.
 
+## Step 13: Review the Contents of Your Media Directory
+
+`_media` is now a passthrough directory: files are no longer filtered by extension, and are published to `_site/media` regardless of their type.
+
+>warning This changes what you deploy. **Review the contents of `_media` before upgrading.** Any normal file stored there, such as design source files, notes, exports, or source maps, will now be publicly accessible on your built site. Move anything that should not be public out of `_media`.
+
 ## Migration Checklist
 
 Use this checklist to track your upgrade progress:
 
+- [ ] Removed any `media_extensions` entry from `config/hyde.php` before updating Composer dependencies
 - [ ] Reviewed `markdown.allow_html` and `markdown.enable_blade` and explicitly selected the appropriate trust policy
 - [ ] Replaced any `php hyde rebuild <path>` usage with `StaticPageBuilder::handle()` or a full `php hyde build`
 - [ ] Moved calls to `Redirect::create()` or `Redirect::store()` into the `hyde.redirects` configuration array
@@ -456,6 +465,7 @@ Use this checklist to track your upgrade progress:
 - [ ] Compared pages against your old site if you have custom CSS for code blocks or their labels
 - [ ] Checked `_posts` for drafts and blog posts dated in the future, and set up recurring builds if scheduling posts
 - [ ] Moved manually maintained files out of the output directory and into `_static`
+- [ ] Reviewed `_media` and moved out anything that shouldn't be public
 
 ## Troubleshooting
 
diff --git a/config/hyde.php b/config/hyde.php
index b667610c7f5..c2b33122046 100644
--- a/config/hyde.php
+++ b/config/hyde.php
@@ -483,10 +483,6 @@
     |
     */
 
-    // Change the file extensions to be considered as media files and are copied to the output directory.
-    // If you want to add more extensions, add it to the empty merge array, or just override the entire array.
-    'media_extensions' => array_merge([], \Hyde\Support\Filesystem\MediaFile::EXTENSIONS),
-
     // Should a JSON build manifest with metadata about the build be generated?
     'generate_build_manifest' => true,
 
diff --git a/docs/_data/partials/hyde-pages-api/hyde-kernel-hyperlink-methods.md b/docs/_data/partials/hyde-pages-api/hyde-kernel-hyperlink-methods.md
index d3d7e31ab61..f7b415b277f 100644
--- a/docs/_data/partials/hyde-pages-api/hyde-kernel-hyperlink-methods.md
+++ b/docs/_data/partials/hyde-pages-api/hyde-kernel-hyperlink-methods.md
@@ -1,7 +1,7 @@
 <section id="hyde-kernel-hyperlink-methods">
 
 <!-- Start generated docs for Hyde\Foundation\Concerns\ForwardsHyperlinks -->
-<!-- Generated by HydePHP DocGen script at 2024-09-08 10:25:34 in 0.11ms -->
+<!-- Generated by HydePHP DocGen script at 2026-10-08 11:22:40 in 0.05ms -->
 
 #### `formatLink()`
 
@@ -27,7 +27,7 @@ No description provided.
 Hyde::asset(string $name): Hyde\Support\Filesystem\MediaFile
 ```
 
-- **Throws:** \Hyde\Framework\Exceptions\FileNotFoundException If the file does not exist in the `_media` source directory.
+- **Throws:** \Hyde\Framework\Exceptions\FileNotFoundException If the file does not exist in the `_media` source directory, or is not published to the site.
 
 #### `url()`
 
diff --git a/docs/architecture-concepts/the-hydekernel.md b/docs/architecture-concepts/the-hydekernel.md
index 6f90671bdb9..282c4770b27 100644
--- a/docs/architecture-concepts/the-hydekernel.md
+++ b/docs/architecture-concepts/the-hydekernel.md
@@ -201,7 +201,7 @@ Hyde::markdown(string $text, bool $normalizeIndentation): Illuminate\Support\Htm
 <section id="hyde-kernel-hyperlink-methods">
 
 <!-- Start generated docs for Hyde\Foundation\Concerns\ForwardsHyperlinks -->
-<!-- Generated by HydePHP DocGen script at 2024-09-08 10:25:34 in 0.11ms -->
+<!-- Generated by HydePHP DocGen script at 2026-10-08 11:22:40 in 0.05ms -->
 
 #### `formatLink()`
 
@@ -227,7 +227,7 @@ No description provided.
 Hyde::asset(string $name): Hyde\Support\Filesystem\MediaFile
 ```
 
-- **Throws:** \Hyde\Framework\Exceptions\FileNotFoundException If the file does not exist in the `_media` source directory.
+- **Throws:** \Hyde\Framework\Exceptions\FileNotFoundException If the file does not exist in the `_media` source directory, or is not published to the site.
 
 #### `url()`
 
diff --git a/docs/creating-content/managing-assets.md b/docs/creating-content/managing-assets.md
index f7663eb3191..229455e2636 100644
--- a/docs/creating-content/managing-assets.md
+++ b/docs/creating-content/managing-assets.md
@@ -98,8 +98,9 @@ Here you will find the `app.css` file that bootstraps the TailwindCSS styles. Th
 to add your custom styles. It is also where we import HydeFront. If you compile this file in the base install,
 it will output the same file that's already included in Hyde.
 
-- The `_media` folder contains **compiled** (and usually minified) files. When Hyde compiles your static site,
-all asset files here will get copied as they are into the `_site/media` folder.
+- The `_media` folder contains your public site assets, such as images, stylesheets, scripts, fonts, and downloads.
+When Hyde compiles your static site, files here are copied as-is into the `_site/media` folder, regardless of file type. This is also
+where Vite writes the compiled (and usually minified) styles and scripts from `resources/assets`.
 
 - The `_site/media` folder contains the files that are served to the user.
 
diff --git a/docs/digging-deeper/customization.md b/docs/digging-deeper/customization.md
index 62d4a563c19..0f36bd30f82 100644
--- a/docs/digging-deeper/customization.md
+++ b/docs/digging-deeper/customization.md
@@ -354,17 +354,6 @@ Learn more in the [Documentation Pages](documentation-pages#sidebar) documentati
 The following configuration options in the `config/hyde.php` file are intended for advanced users and
 should only be modified if you fully understand their impact. The code examples show the default values.
 
-### `media_extensions`
-
-This option allows you to specify file extensions considered as media files, which will be copied to the output directory.
-To add more extensions, either append them to the existing array or override the entire array.
-
-```php title="config/hyde.php"
-use \Hyde\Support\Filesystem\MediaFile;
-
-'media_extensions' => array_merge([], MediaFile::EXTENSIONS),
-```
-
 ### `generate_build_manifest`
 
 Determines whether a JSON build manifest with metadata about the build should be generated. Set to `true` to enable.
diff --git a/docs/getting-started/core-concepts.md b/docs/getting-started/core-concepts.md
index a85cbe58802..67b204cbfdc 100644
--- a/docs/getting-started/core-concepts.md
+++ b/docs/getting-started/core-concepts.md
@@ -38,7 +38,7 @@ To take full advantage of the framework, it may first be good to familiarize our
 | `_docs`            | For documentation pages                                     |
 | `_posts`           | For blog posts                                              |
 | `_pages`           | For static Markdown and Blade pages                         |
-| `_media`           | Store static assets to be copied to the build directory     |
+| `_media`           | Public site assets copied as-is to the build directory      |
 | `_site`            | The build directory where your compiled site will be stored |
 | `config`           | Configuration files for Hyde and integrations               |
 | `resources/assets` | Location for CSS/JS Vite source files (optional)            |
@@ -72,7 +72,7 @@ All source and output directories are configurable, but the defaults are as foll
 | Static Pages   | `_pages/`        | `_site/`         | `.md`, `.blade.php` |
 | Blog Posts     | `_posts/`        | `_site/posts/`   | `.md`               |
 | Documentation  | `_docs/`         | `_site/docs/`    | `.md`               |
-| Media Assets   | `_media/`        | `_site/media/`   | Common asset types  |
+| Media Assets   | `_media/`        | `_site/media/`   | Any file type       |
 
 ## Paths, Identifiers, and Route Keys
 
diff --git a/packages/framework/config/hyde.php b/packages/framework/config/hyde.php
index b667610c7f5..c2b33122046 100644
--- a/packages/framework/config/hyde.php
+++ b/packages/framework/config/hyde.php
@@ -483,10 +483,6 @@
     |
     */
 
-    // Change the file extensions to be considered as media files and are copied to the output directory.
-    // If you want to add more extensions, add it to the empty merge array, or just override the entire array.
-    'media_extensions' => array_merge([], \Hyde\Support\Filesystem\MediaFile::EXTENSIONS),
-
     // Should a JSON build manifest with metadata about the build be generated?
     'generate_build_manifest' => true,
 
diff --git a/packages/framework/src/Facades/Asset.php b/packages/framework/src/Facades/Asset.php
index 3bc01acfa1c..c6695a6766e 100644
--- a/packages/framework/src/Facades/Asset.php
+++ b/packages/framework/src/Facades/Asset.php
@@ -16,7 +16,7 @@ class Asset
     /**
      * Get a MediaFile instance for the given filename in the media source directory.
      *
-     * @throws \Hyde\Framework\Exceptions\FileNotFoundException If the file does not exist in the `_media` source directory.
+     * @throws \Hyde\Framework\Exceptions\FileNotFoundException If the file does not exist in the `_media` source directory, or is not published to the site.
      */
     public static function get(string $file): MediaFile
     {
diff --git a/packages/framework/src/Foundation/Concerns/ForwardsHyperlinks.php b/packages/framework/src/Foundation/Concerns/ForwardsHyperlinks.php
index 9c7cd2aded7..960f8e6d1e6 100644
--- a/packages/framework/src/Foundation/Concerns/ForwardsHyperlinks.php
+++ b/packages/framework/src/Foundation/Concerns/ForwardsHyperlinks.php
@@ -24,7 +24,7 @@ public function relativeLink(string $destination): string
         return $this->hyperlinks->relativeLink($destination);
     }
 
-    /** @throws \Hyde\Framework\Exceptions\FileNotFoundException If the file does not exist in the `_media` source directory. */
+    /** @throws \Hyde\Framework\Exceptions\FileNotFoundException If the file does not exist in the `_media` source directory, or is not published to the site. */
     public function asset(string $name): MediaFile
     {
         return $this->hyperlinks->asset($name);
diff --git a/packages/framework/src/Foundation/Concerns/HasMediaFiles.php b/packages/framework/src/Foundation/Concerns/HasMediaFiles.php
index ce1d7a1ab31..67427b31753 100644
--- a/packages/framework/src/Foundation/Concerns/HasMediaFiles.php
+++ b/packages/framework/src/Foundation/Concerns/HasMediaFiles.php
@@ -5,7 +5,6 @@
 namespace Hyde\Foundation\Concerns;
 
 use Hyde\Hyde;
-use Hyde\Facades\Config;
 use Hyde\Facades\Filesystem;
 use Hyde\Support\Filesystem\MediaFile;
 use Illuminate\Support\Collection;
@@ -38,13 +37,11 @@ protected static function discoverMediaFiles(): Collection
             $file = MediaFile::make($path);
 
             return [$file->getIdentifier() => $file];
-        });
+        })->filter(fn (MediaFile $file, string $identifier): bool => MediaFile::isPublishable($identifier));
     }
 
     protected static function getMediaFiles(): array
     {
-        return Filesystem::findFiles(Hyde::getMediaDirectory(),
-            Config::getArray('hyde.media_extensions', MediaFile::EXTENSIONS), recursive: true
-        )->all();
+        return Filesystem::findFiles(Hyde::getMediaDirectory(), recursive: true)->all();
     }
 }
diff --git a/packages/framework/src/Foundation/Kernel/Hyperlinks.php b/packages/framework/src/Foundation/Kernel/Hyperlinks.php
index c23498ebae3..f66b882c97c 100644
--- a/packages/framework/src/Foundation/Kernel/Hyperlinks.php
+++ b/packages/framework/src/Foundation/Kernel/Hyperlinks.php
@@ -92,7 +92,7 @@ public function relativeLink(string $destination): string
      * If a base URL is configured, the image will be returned with a qualified absolute URL.
      * Otherwise, a relative path will be returned based on the rendered page's location.
      *
-     * @throws \Hyde\Framework\Exceptions\FileNotFoundException If the file does not exist in the `_media` source directory.
+     * @throws \Hyde\Framework\Exceptions\FileNotFoundException If the file does not exist in the `_media` source directory, or is not published to the site.
      */
     public function asset(string $name): MediaFile
     {
diff --git a/packages/framework/src/Framework/Actions/PreBuildTasks/TransferMediaAssets.php b/packages/framework/src/Framework/Actions/PreBuildTasks/TransferMediaAssets.php
index ac6d3783204..b1c85fdfc3c 100644
--- a/packages/framework/src/Framework/Actions/PreBuildTasks/TransferMediaAssets.php
+++ b/packages/framework/src/Framework/Actions/PreBuildTasks/TransferMediaAssets.php
@@ -4,12 +4,18 @@
 
 namespace Hyde\Framework\Actions\PreBuildTasks;
 
+use ErrorException;
+use RuntimeException;
 use Hyde\Facades\Config;
 use Hyde\Facades\Filesystem;
 use Hyde\Support\Filesystem\MediaFile;
+use Symfony\Component\Console\Command\Command;
 use Hyde\Framework\Features\BuildTasks\PreBuildTask;
 use Hyde\Framework\Concerns\InteractsWithDirectories;
 
+use function implode;
+use function array_map;
+
 class TransferMediaAssets extends PreBuildTask
 {
     protected static string $message = 'Transferring Media Assets';
@@ -30,13 +36,34 @@ public function handle(): void
             $this->skip("No media files to transfer.\n");
         }
 
-        $this->withProgressBar($files, function (MediaFile $file): void {
+        $failures = [];
+
+        $this->withProgressBar($files, function (MediaFile $file) use (&$failures): void {
             $sitePath = $file->getOutputPath();
-            $this->needsParentDirectory($sitePath);
-            Filesystem::putContents($sitePath, $file->getContents());
+            $transfer = "[{$file->getPath()}] to [{$sitePath}]";
+
+            try {
+                $this->needsParentDirectory($sitePath);
+                $copied = Filesystem::copy($file->getPath(), $sitePath);
+            } catch (ErrorException $exception) {
+                $failures[] = "$transfer: {$exception->getMessage()}";
+
+                return;
+            }
+
+            if (! $copied) {
+                $failures[] = $transfer;
+            }
         });
 
         $this->newLine();
+
+        if ($failures !== []) {
+            throw new RuntimeException(
+                "Failed to copy media file(s):\n".implode("\n", array_map(fn (string $failure): string => "- $failure", $failures)),
+                Command::FAILURE
+            );
+        }
     }
 
     public function printFinishMessage(): void
diff --git a/packages/framework/src/Markdown/Processing/DynamicMarkdownLinkProcessor.php b/packages/framework/src/Markdown/Processing/DynamicMarkdownLinkProcessor.php
index c14732b2e09..140281ca7b7 100644
--- a/packages/framework/src/Markdown/Processing/DynamicMarkdownLinkProcessor.php
+++ b/packages/framework/src/Markdown/Processing/DynamicMarkdownLinkProcessor.php
@@ -26,6 +26,10 @@ public static function postprocess(string $html): string
         }
 
         foreach (static::assetMap() as $sourcePath => $mediaFile) {
+            if (! str_contains($html, $sourcePath)) {
+                continue;
+            }
+
             $patterns = [
                 sprintf('<img src="%s"', $sourcePath),
                 sprintf('<img src="/%s"', $sourcePath),
diff --git a/packages/framework/src/Support/Filesystem/MediaFile.php b/packages/framework/src/Support/Filesystem/MediaFile.php
index 888cd91ae39..041ae3fac1a 100644
--- a/packages/framework/src/Support/Filesystem/MediaFile.php
+++ b/packages/framework/src/Support/Filesystem/MediaFile.php
@@ -16,6 +16,14 @@
 use function Hyde\path_join;
 use function Hyde\trim_slashes;
 use function array_merge;
+use function array_pop;
+use function explode;
+use function in_array;
+use function sprintf;
+use function str_replace;
+use function str_starts_with;
+use function strtolower;
+use function trim;
 
 /**
  * File abstraction for a project media file.
@@ -24,8 +32,11 @@
  */
 class MediaFile extends ProjectFile implements Stringable
 {
-    /** @var array<string> The default extensions for media types */
-    final public const EXTENSIONS = ['png', 'svg', 'jpg', 'jpeg', 'webp', 'gif', 'ico', 'css', 'js'];
+    /** @var array<string> Operating system metadata files that are never published, compared case-insensitively */
+    protected const IGNORED_FILENAMES = ['thumbs.db', 'desktop.ini'];
+
+    /** @var array<string> Version control directories that are never published, matching Symfony Finder's exclusions */
+    protected const VCS_DIRECTORIES = ['.svn', '_svn', 'CVS', '_darcs', '.arch-params', '.monotone', '.bzr', '.git', '.hg'];
 
     protected readonly int $length;
     protected readonly string $mimeType;
@@ -62,11 +73,21 @@ public static function make(string $path): static
     /**
      * Get or create a media file instance from the HydeKernel for the given file.
      *
-     * @throws \Hyde\Framework\Exceptions\FileNotFoundException If the file does not exist in the `_media` source directory.
+     * @throws \Hyde\Framework\Exceptions\FileNotFoundException If the file does not exist in the `_media` source directory, or is not published to the site.
      */
     public static function get(string $path): MediaFile
     {
-        return Hyde::assets()->get($path) ?? static::make($path);
+        $file = Hyde::assets()->get($path) ?? static::make($path);
+
+        if (! static::isPublishable($file->getIdentifier())) {
+            throw new FileNotFoundException($file->getPath(), sprintf(
+                'File [%s] is not published to the built site, so it cannot be used as an asset. '
+                .'Dotfiles, version control directories, Thumbs.db, and desktop.ini are excluded from the media directory.',
+                $file->getPath()
+            ));
+        }
+
+        return $file;
     }
 
     /**
@@ -89,6 +110,31 @@ public static function files(): array
         return static::all()->keys()->all();
     }
 
+    /**
+     * Determine whether a file in the media directory is published to the site.
+     *
+     * Shared by the build and the realtime compiler, which calls it before the application boots,
+     * so it must not depend on application state.
+     *
+     * @internal
+     *
+     * @param  string  $path  The file path relative to the media source directory.
+     */
+    public static function isPublishable(string $path): bool
+    {
+        $segments = explode('/', trim(str_replace('\\', '/', $path), '/'));
+        $filename = array_pop($segments);
+
+        foreach ($segments as $directory) {
+            if (str_starts_with($directory, '.') || in_array($directory, static::VCS_DIRECTORIES, true)) {
+                return false;
+            }
+        }
+
+        return $filename !== '' && ! str_starts_with($filename, '.')
+            && ! in_array(strtolower($filename), static::IGNORED_FILENAMES, true);
+    }
+
     /**
      * Get the absolute path to the media source directory, or a file within it.
      */
diff --git a/packages/framework/src/helpers.php b/packages/framework/src/helpers.php
index c7089ef6f74..7e75d74a6b2 100644
--- a/packages/framework/src/helpers.php
+++ b/packages/framework/src/helpers.php
@@ -27,7 +27,7 @@ function hyde(): HydeKernel
              * If a base URL is configured, the image will be returned with a qualified absolute URL.
              * Otherwise, a relative path will be returned based on the rendered page's location.
              *
-             * @throws \Hyde\Framework\Exceptions\FileNotFoundException If the file does not exist in the `_media` source directory.
+             * @throws \Hyde\Framework\Exceptions\FileNotFoundException If the file does not exist in the `_media` source directory, or is not published to the site.
              */
             function asset(string $name): MediaFile
             {
diff --git a/packages/framework/tests/Feature/DiscoveryServiceTest.php b/packages/framework/tests/Feature/DiscoveryServiceTest.php
index de5de419a09..3615c704bec 100644
--- a/packages/framework/tests/Feature/DiscoveryServiceTest.php
+++ b/packages/framework/tests/Feature/DiscoveryServiceTest.php
@@ -103,10 +103,7 @@ public function testGetMediaAssetFilesDiscoversCustomFileTypes()
     {
         $path = 'test.custom';
         $this->file("_media/$path");
-        $this->assertNotContains($path, MediaFile::files());
-        self::mockConfig(['hyde.media_extensions' => ['custom']]);
 
-        $this->resetKernel(); // Reboot to rediscover new files
         $this->assertContains($path, MediaFile::files());
     }
 
@@ -127,33 +124,6 @@ public function testGetMediaAssetFilesDiscoversFilesVeryRecursively()
         Filesystem::deleteDirectory('_media/foo');
     }
 
-    public function testMediaAssetExtensionsCanBeAddedByCommaSeparatedValues()
-    {
-        self::mockConfig(['hyde.media_extensions' => []]);
-        $this->file('_media/test.1');
-        $this->file('_media/test.2');
-        $this->file('_media/test.3');
-
-        $this->assertSame([], MediaFile::files());
-
-        self::mockConfig(['hyde.media_extensions' => ['1,2,3']]);
-        $this->resetKernel(); // Reboot to rediscover new files
-        $this->assertSame(['test.1', 'test.2', 'test.3'], MediaFile::files());
-    }
-
-    public function testMediaAssetExtensionsCanBeAddedByArray()
-    {
-        self::mockConfig(['hyde.media_extensions' => []]);
-        $this->file('_media/test.1');
-        $this->file('_media/test.2');
-        $this->file('_media/test.3');
-
-        $this->assertSame([], MediaFile::files());
-        self::mockConfig(['hyde.media_extensions' => ['1', '2', '3']]);
-        $this->resetKernel(); // Reboot to rediscover new files
-        $this->assertSame(['test.1', 'test.2', 'test.3'], MediaFile::files());
-    }
-
     public function testBladePageFilesStartingWithUnderscoreAreIgnored()
     {
         $this->file('_pages/_foo.blade.php');
diff --git a/packages/framework/tests/Feature/StaticSiteServiceTest.php b/packages/framework/tests/Feature/StaticSiteServiceTest.php
index fd4a21c0071..0f8cca0cbae 100644
--- a/packages/framework/tests/Feature/StaticSiteServiceTest.php
+++ b/packages/framework/tests/Feature/StaticSiteServiceTest.php
@@ -4,6 +4,7 @@
 
 namespace Hyde\Framework\Testing\Feature;
 
+use Mockery;
 use Hyde\Facades\Filesystem;
 use Hyde\Hyde;
 use Hyde\Support\BuildWarnings;
@@ -13,6 +14,7 @@
 use Illuminate\Support\Facades\Process;
 use Hyde\Framework\HydeServiceProvider;
 use Hyde\Framework\Actions\StaticPageBuilder;
+use Illuminate\Filesystem\Filesystem as BaseFilesystem;
 use Hyde\Framework\Exceptions\InvalidConfigurationException;
 
 #[\PHPUnit\Framework\Attributes\CoversClass(\Hyde\Console\Commands\BuildSiteCommand::class)]
@@ -94,17 +96,93 @@ public function testBuildCommandCreatesNeededMediaDirectoriesRecursively()
         $this->assertFileExists(Hyde::path('_site/media/foo/bar/3.png'));
     }
 
-    public function testBuildCommandSkipsMediaTransferWhenThereAreNoAssets()
+    public function testBuildCommandDiscoversAndTransfersArbitraryFileTypesWithStructurePreserved()
     {
-        rename(Hyde::path('_media/app.css'), Hyde::path('_media/app.css.bak'));
+        $this->file('_media/document.pdf', 'pdf content');
+        $this->file('_media/font.woff2', 'font content');
+        $this->file('_media/archive.zip', 'zip content');
+        $this->file('_media/nested/deep/file.xyz', 'nested content');
 
-        $this->artisan('build')
-            ->expectsOutputToContain('Transferring Media Assets... ')
-            ->expectsOutputToContain('Skipped')
-            ->expectsOutputToContain('> No media files to transfer.')
-            ->assertExitCode(0);
+        $this->artisan('build')->assertExitCode(0);
+
+        $this->assertFileEquals(Hyde::path('_media/document.pdf'), Hyde::path('_site/media/document.pdf'));
+        $this->assertFileEquals(Hyde::path('_media/font.woff2'), Hyde::path('_site/media/font.woff2'));
+        $this->assertFileEquals(Hyde::path('_media/archive.zip'), Hyde::path('_site/media/archive.zip'));
+        $this->assertFileEquals(Hyde::path('_media/nested/deep/file.xyz'), Hyde::path('_site/media/nested/deep/file.xyz'));
+    }
+
+    public function testBuildCommandIgnoresThumbsDbAndHiddenOrVcsFiles()
+    {
+        $this->file('_media/Thumbs.db');
+        $this->file('_media/desktop.ini');
+        $this->file('_media/.gitkeep');
+        $this->file('_media/.DS_Store');
+        $this->file('_media/.env');
+        $this->file('_media/.git/config');
+
+        $this->artisan('build')->assertExitCode(0);
+
+        $this->assertFileDoesNotExist(Hyde::path('_site/media/Thumbs.db'));
+        $this->assertFileDoesNotExist(Hyde::path('_site/media/desktop.ini'));
+        $this->assertFileDoesNotExist(Hyde::path('_site/media/.gitkeep'));
+        $this->assertFileDoesNotExist(Hyde::path('_site/media/.DS_Store'));
+        $this->assertFileDoesNotExist(Hyde::path('_site/media/.env'));
+        $this->assertDirectoryDoesNotExist(Hyde::path('_site/media/.git'));
+    }
 
-        rename(Hyde::path('_media/app.css.bak'), Hyde::path('_media/app.css'));
+    public function testBuildCommandTransfersEveryFileBeforeReportingAFailedMediaCopy()
+    {
+        $this->file('_media/good.txt', 'ok');
+        $this->file('_media/bad.txt', 'nope');
+
+        $mock = Mockery::mock(BaseFilesystem::class)->makePartial();
+        $mock->shouldReceive('copy')->withArgs(fn (string $path): bool => str_contains($path, 'bad.txt'))->andReturn(false);
+        $mock->shouldReceive('copy')->withArgs(fn (string $path): bool => ! str_contains($path, 'bad.txt'))->passthru();
+        app()->instance(BaseFilesystem::class, $mock);
+
+        $this->artisan('build')->expectsOutputToContain('[_media/bad.txt] to ['.Hyde::path('_site/media/bad.txt').']');
+
+        $this->assertFileExists(Hyde::path('_site/media/good.txt'));
+
+        app()->forgetInstance(BaseFilesystem::class);
+    }
+
+    public function testBuildCommandTransfersEveryFileBeforeReportingACopyThatThrows()
+    {
+        $this->file('_media/good.txt', 'ok');
+        $this->file('_media/bad.txt', 'nope');
+
+        $mock = Mockery::mock(BaseFilesystem::class)->makePartial();
+        $mock->shouldReceive('copy')->withArgs(fn (string $path): bool => str_contains($path, 'bad.txt'))
+            ->andReturnUsing(fn (string $path, string $target): bool => copy(Hyde::path('missing/source.txt'), $target));
+        $mock->shouldReceive('copy')->withArgs(fn (string $path): bool => ! str_contains($path, 'bad.txt'))->passthru();
+        app()->instance(BaseFilesystem::class, $mock);
+
+        try {
+            $this->artisan('build')->expectsOutputToContain(
+                '[_media/bad.txt] to ['.Hyde::path('_site/media/bad.txt').']: copy('.Hyde::path('missing/source.txt').'): Failed to open stream'
+            );
+
+            $this->assertFileExists(Hyde::path('_site/media/good.txt'));
+        } finally {
+            app()->forgetInstance(BaseFilesystem::class);
+        }
+    }
+
+    public function testBuildCommandSkipsMediaTransferWhenThereAreNoAssets()
+    {
+        // The file must leave the media directory entirely, since renaming it within a passthrough directory wouldn't empty it.
+        rename(Hyde::path('_media/app.css'), Hyde::path('app.css.bak'));
+
+        try {
+            $this->artisan('build')
+                ->expectsOutputToContain('Transferring Media Assets... ')
+                ->expectsOutputToContain('Skipped')
+                ->expectsOutputToContain('> No media files to transfer.')
+                ->assertExitCode(0);
+        } finally {
+            rename(Hyde::path('app.css.bak'), Hyde::path('_media/app.css'));
+        }
     }
 
     public function testBuildCommandDoesNotUseViteDevServerPathEvenWhenViteIsRunning()
diff --git a/packages/framework/tests/Feature/Support/MediaFileTest.php b/packages/framework/tests/Feature/Support/MediaFileTest.php
index 8d284490cc6..a3e4e080c10 100644
--- a/packages/framework/tests/Feature/Support/MediaFileTest.php
+++ b/packages/framework/tests/Feature/Support/MediaFileTest.php
@@ -84,6 +84,46 @@ public function testMediaFileExceptionHandling()
         MediaFile::make('non_existent_file.txt')->getLength();
     }
 
+    #[\PHPUnit\Framework\Attributes\DataProvider('unpublishedMediaFilesProvider')]
+    public function testExistingFilesThatAreNotPublishedCannotBeResolvedAsAssets(string $file)
+    {
+        $this->file("_media/$file");
+
+        $this->expectException(FileNotFoundException::class);
+        $this->expectExceptionMessage("File [_media/$file] is not published to the built site");
+
+        Hyde::asset($file);
+    }
+
+    #[\PHPUnit\Framework\Attributes\DataProvider('unpublishedMediaFilesProvider')]
+    public function testGettingAFileThatIsNotPublishedThrows(string $file)
+    {
+        $this->file("_media/$file");
+
+        $this->expectException(FileNotFoundException::class);
+
+        MediaFile::get($file);
+    }
+
+    public function testFilesThatAreStillPublishedCanBeResolvedAsAssets()
+    {
+        $this->file('_media/report.pdf');
+
+        $this->assertSame('_media/report.pdf', Hyde::asset('report.pdf')->getPath());
+    }
+
+    public static function unpublishedMediaFilesProvider(): array
+    {
+        return [
+            'dotfile' => ['.env'],
+            'nested dotfile' => ['images/.DS_Store'],
+            'dot directory' => ['.well-known/security.txt'],
+            'version control directory' => ['.git/config'],
+            'Thumbs.db' => ['Thumbs.db'],
+            'desktop.ini' => ['images/desktop.ini'],
+        ];
+    }
+
     public function testMediaDirectoryCustomization()
     {
         Hyde::setMediaDirectory('custom_media');
diff --git a/packages/framework/tests/Unit/Foundation/FilesystemHasMediaFilesTest.php b/packages/framework/tests/Unit/Foundation/FilesystemHasMediaFilesTest.php
index edfd66b8c01..7c21137969f 100644
--- a/packages/framework/tests/Unit/Foundation/FilesystemHasMediaFilesTest.php
+++ b/packages/framework/tests/Unit/Foundation/FilesystemHasMediaFilesTest.php
@@ -82,7 +82,7 @@ public function testUsesRecursiveFinderSearch()
 
         (new Filesystem(Hyde::getInstance()))->assets();
 
-        $mock->shouldHaveReceived('handle')->with('_media', MediaFile::EXTENSIONS, true);
+        $mock->shouldHaveReceived('handle')->with('_media', false, true);
     }
 
     public function testItSupportsCustomMediaDirectory()
@@ -93,18 +93,38 @@ public function testItSupportsCustomMediaDirectory()
 
         (new Filesystem(Hyde::getInstance()))->assets();
 
-        $mock->shouldHaveReceived('handle')->with('assets', MediaFile::EXTENSIONS, true);
+        $mock->shouldHaveReceived('handle')->with('assets', false, true);
     }
 
-    public function testItSupportsCustomExtensions()
+    public function testItIgnoresThumbsDbAndDesktopIniRegardlessOfCase()
     {
-        self::mockConfig(['hyde.media_extensions' => ['gif', 'svg']]);
+        $this->mockFileFinder([
+            '_media/Thumbs.db',
+            '_media/thumbs.db',
+            '_media/Desktop.ini',
+            '_media/desktop.ini',
+            '_media/image.png',
+        ]);
 
-        $mock = $this->mockFileFinder();
+        $assets = (new Filesystem(Hyde::getInstance()))->assets();
 
-        (new Filesystem(Hyde::getInstance()))->assets();
+        $this->assertCount(1, $assets);
+        $this->assertTrue($assets->has('image.png'));
+    }
+
+    public function testItIgnoresFilesThatAreNotPublishable()
+    {
+        $this->mockFileFinder([
+            '_media/.gitkeep',
+            '_media/.hidden/file.txt',
+            '_media/.git/config',
+            '_media/CVS/Entries',
+            '_media/fonts/inter.woff2',
+        ]);
+
+        $assets = (new Filesystem(Hyde::getInstance()))->assets();
 
-        $mock->shouldHaveReceived('handle')->with('_media', ['gif', 'svg'], true);
+        $this->assertSame(['fonts/inter.woff2'], $assets->keys()->all());
     }
 
     public function testDiscoverMediaFilesWithEmptyResult()
@@ -131,10 +151,10 @@ public function testDiscoverMediaFilesWithMultipleFiles()
         $this->assertInstanceOf(MediaFile::class, $result->get('document.pdf'));
     }
 
-    protected function mockFileFinder(): MockInterface
+    protected function mockFileFinder(array $files = []): MockInterface
     {
         $mock = Mockery::mock(FileFinder::class);
-        $mock->shouldReceive('handle')->andReturn(collect());
+        $mock->shouldReceive('handle')->andReturn(collect($files));
         app()->instance(FileFinder::class, $mock);
 
         return $mock;
diff --git a/packages/framework/tests/Unit/MediaDirectoryCanBeChangedTest.php b/packages/framework/tests/Unit/MediaDirectoryCanBeChangedTest.php
index c1dc7be7599..2a083d2f070 100644
--- a/packages/framework/tests/Unit/MediaDirectoryCanBeChangedTest.php
+++ b/packages/framework/tests/Unit/MediaDirectoryCanBeChangedTest.php
@@ -25,6 +25,7 @@ public function testMediaOutputDirectoryCanBeChangedForSiteBuilds()
 
         $this->directory('_assets');
         $this->file('_assets/app.css');
+        $this->file('_assets/document.pdf');
 
         Hyde::setMediaDirectory('_assets');
 
@@ -33,6 +34,7 @@ public function testMediaOutputDirectoryCanBeChangedForSiteBuilds()
         $this->assertDirectoryDoesNotExist(Hyde::path('_site/media'));
         $this->assertDirectoryExists(Hyde::path('_site/assets'));
         $this->assertFileExists(Hyde::path('_site/assets/app.css'));
+        $this->assertFileExists(Hyde::path('_site/assets/document.pdf'));
 
         $this->resetSite();
     }
diff --git a/packages/framework/tests/Unit/Support/MediaFileUnitTest.php b/packages/framework/tests/Unit/Support/MediaFileUnitTest.php
index 613c614ca31..44dd92e11b6 100644
--- a/packages/framework/tests/Unit/Support/MediaFileUnitTest.php
+++ b/packages/framework/tests/Unit/Support/MediaFileUnitTest.php
@@ -71,6 +71,12 @@ protected function tearDown(): void
         $this->verifyMockeryExpectations();
     }
 
+    #[\PHPUnit\Framework\Attributes\DataProvider('publishablePathsProvider')]
+    public function testIsPublishable(string $path, bool $expected)
+    {
+        $this->assertSame($expected, MediaFile::isPublishable($path));
+    }
+
     public function testCanConstruct()
     {
         $file = new MediaFile('foo');
@@ -614,6 +620,33 @@ protected function mockCurrentPage(string $page): void
         Render::shouldReceive('getRouteKey')->andReturn($page);
     }
 
+    public static function publishablePathsProvider(): \Iterator
+    {
+        yield ['app.css', true];
+        yield ['report.pdf', true];
+        yield ['fonts/inter.woff2', true];
+        yield ['downloads/archive.zip', true];
+        yield ['nested/deeply/data.json', true];
+        yield ['README', true];
+        yield ['nested\\windows\\path.png', true];
+        yield ['CVS', true];
+        yield ['Thumbs.db', false];
+        yield ['images/THUMBS.DB', false];
+        yield ['desktop.ini', false];
+        yield ['images/Desktop.ini', false];
+        yield ['.gitkeep', false];
+        yield ['.DS_Store', false];
+        yield ['images/.env', false];
+        yield ['.well-known/security.txt', false];
+        yield ['nested/.hidden/file.txt', false];
+        yield ['.git/config', false];
+        yield ['CVS/Entries', false];
+        yield ['nested/_darcs/file', false];
+        yield ['../outside.txt', false];
+        yield ['nested/../../outside.txt', false];
+        yield ['', false];
+    }
+
     public static function bootableMethodsProvider(): \Iterator
     {
         yield ['getLength'];
diff --git a/packages/realtime-compiler/src/Actions/AssetFileLocator.php b/packages/realtime-compiler/src/Actions/AssetFileLocator.php
index 2a53833f583..edfc47c967c 100644
--- a/packages/realtime-compiler/src/Actions/AssetFileLocator.php
+++ b/packages/realtime-compiler/src/Actions/AssetFileLocator.php
@@ -4,6 +4,8 @@
 
 namespace Hyde\RealtimeCompiler\Actions;
 
+use Hyde\Support\Filesystem\MediaFile;
+
 /**
  * Locate a static file to proxy.
  */
@@ -20,9 +22,10 @@ public static function find(string $path): ?string
         }
 
         if (static::isMediaPath($path)) {
-            $media = BASE_PATH.'/'.static::mediaDirectory().'/'.substr($path, strlen(static::mediaOutputDirectory()) + 1);
+            $relativePath = substr($path, strlen(static::mediaOutputDirectory()) + 1);
+            $media = BASE_PATH.'/'.static::mediaDirectory().'/'.$relativePath;
 
-            if (is_file($media)) {
+            if (MediaFile::isPublishable($relativePath) && is_file($media)) {
                 return $media;
             }
         }
diff --git a/packages/realtime-compiler/tests/RealtimeCompilerTest.php b/packages/realtime-compiler/tests/RealtimeCompilerTest.php
index 2b4c7309030..ba9549b3486 100644
--- a/packages/realtime-compiler/tests/RealtimeCompilerTest.php
+++ b/packages/realtime-compiler/tests/RealtimeCompilerTest.php
@@ -190,6 +190,40 @@ public function testStaticDirectoryTakesPrecedenceForMediaPath(): void
         }
     }
 
+    public function testServesTheSameMediaFilesThatTheBuildPublishes(): void
+    {
+        $files = [
+            'parity/report.pdf' => true,
+            'parity/fonts/inter.woff2' => true,
+            'parity/nested/data.json' => true,
+            'parity/Thumbs.db' => false,
+            'parity/DESKTOP.INI' => false,
+            'parity/.hidden' => false,
+            'parity/.well-known/security.txt' => false,
+            'parity/.git/config' => false,
+            'parity/CVS/Entries' => false,
+        ];
+
+        foreach (array_keys($files) as $file) {
+            Filesystem::ensureDirectoryExists(dirname("_media/$file"));
+            Filesystem::put("_media/$file", 'contents');
+        }
+
+        try {
+            $published = (new \Hyde\Foundation\Kernel\Filesystem(Hyde::getInstance()))->assets();
+
+            foreach ($files as $file => $expected) {
+                $this->mockCompilerRoute("media/$file");
+                $response = (new HttpKernel())->handle(new Request());
+
+                $this->assertSame($expected, $published->has($file), "Unexpected build discovery result for [$file]");
+                $this->assertSame($expected ? 200 : 404, $response->statusCode, "Unexpected serve result for [$file]");
+            }
+        } finally {
+            Filesystem::deleteDirectory('_media/parity');
+        }
+    }
+
     public function testThrowsRouteNotFoundExceptionForMissingRoute()
     {
         $this->mockCompilerRoute('missing');