diff --git a/commands/web/phpstan b/commands/web/phpstan
index 5c54c8f..9e64765 100755
--- a/commands/web/phpstan
+++ b/commands/web/phpstan
@@ -181,8 +181,8 @@ DEFAULT_PATHS=()
 EXCLUDE_PATHS=(
   "${DOCROOT}/modules/contrib"
   "${DOCROOT}/themes/contrib"
-  "${DOCROOT}/sites/*/files"
-  "sites/*/files"
+  "${DOCROOT}/sites/*/files/*"
+  "sites/*/files/*"
 )
 # Prefer explicit project configs before falling back to CI template config.
 for config_file in phpstan.neon phpstan.neon.dist phpstan.dist.neon; do
diff --git a/drupal-code-quality/config-amendments/phpstan.dcq.neon b/drupal-code-quality/config-amendments/phpstan.dcq.neon
index 7332753..3e630ca 100644
--- a/drupal-code-quality/config-amendments/phpstan.dcq.neon
+++ b/drupal-code-quality/config-amendments/phpstan.dcq.neon
@@ -9,7 +9,7 @@ parameters:
         - __DOCROOT__/sites
     excludePaths:
         analyseAndScan:
-            - __DOCROOT__/sites/*/files
+            - __DOCROOT__/sites/*/files/*
 
 # Baseline guidance:
 # - Generate a baseline with: ddev phpstan --generate-baseline
diff --git a/tests/test.bats b/tests/test.bats
index b8d2101..cb35982 100644
--- a/tests/test.bats
+++ b/tests/test.bats
@@ -968,7 +968,7 @@ PY
   assert_success
   run grep -q "docroot/sites" phpstan.neon
   assert_success
-  run grep -q "docroot/sites/\*/files" phpstan.neon
+  run grep -q "docroot/sites/\*/files/\*" phpstan.neon
   assert_success
 }
 
@@ -1010,10 +1010,33 @@ PY
   # Check for excludePaths
   run grep -q "excludePaths:" phpstan.neon
   assert_success
-  run grep -q "web/sites/\*/files" phpstan.neon
+  run grep -q "web/sites/\*/files/\*" phpstan.neon
   assert_success
 }
 
+@test "phpstan excludes nested files directory descendants" {
+  set -u -o pipefail
+  run ddev add-on get "${DIR}"
+  assert_success
+
+  mkdir -p web/sites/default/files/php/twig/test-subdir
+  cat > web/sites/default/files/php/twig/test-subdir/should-not-scan.php <<'PHP'
+<?php
+
+final class DcqPhpstanExcludeProbe {}
+PHP
+
+  run ddev phpstan analyse --debug -c phpstan.neon web/sites
+  assert_failure
+
+  case "$output" in
+    *"test-subdir/should-not-scan.php"*)
+      echo "Expected phpstan excludePaths to skip files descendants under web/sites/*/files."
+      return 1
+      ;;
+  esac
+}
+
 @test "cspell config is expanded during installation" {
   set -u -o pipefail
   run ddev add-on get "${DIR}"