diff --git a/src/cargo/ops/cargo_package/mod.rs b/src/cargo/ops/cargo_package/mod.rs
index 92282751f81..1c096816b55 100644
--- a/src/cargo/ops/cargo_package/mod.rs
+++ b/src/cargo/ops/cargo_package/mod.rs
@@ -161,7 +161,9 @@ fn create_package(
     }
 
     let filename = pkg.package_id().tarball_name();
-    let dir = ws.build_dir().join("package");
+    let build_dir = ws.build_dir();
+    paths::create_dir_all_excluded_from_backups_atomic(build_dir.as_path_unlocked())?;
+    let dir = build_dir.join("package");
     let mut dst = {
         let tmp = format!(".{}", filename);
         dir.open_rw_exclusive_create(&tmp, gctx, "package scratch space")?
@@ -225,6 +227,7 @@ pub fn package(ws: &Workspace<'_>, opts: &PackageOpts<'_>) -> CargoResult<Vec<Fi
         result.extend(packaged.into_iter().map(|(_, _, src)| src));
     } else {
         // Uplifting artifacts
+        paths::create_dir_all_excluded_from_backups_atomic(target_dir.as_path_unlocked())?;
         let artifact_dir = target_dir.join("package");
         for (pkg, _, src) in packaged {
             let filename = pkg.package_id().tarball_name();
diff --git a/tests/testsuite/package.rs b/tests/testsuite/package.rs
index 4b149928d05..3720b88850b 100644
--- a/tests/testsuite/package.rs
+++ b/tests/testsuite/package.rs
@@ -7807,3 +7807,32 @@ fn publish_to_alt_registry_warns() {
 "#]])
         .run();
 }
+
+#[cargo_test]
+fn package_dir_not_excluded_from_backups() {
+    // Verify that target directory is excluded from backups by checking for CACHEDIR.TAG
+    let p = project()
+        .file("src/main.rs", r#"fn main() { println!("hello"); }"#)
+        .build();
+
+    p.cargo("package --allow-dirty")
+        .with_stderr_data(str![[r#"
+[WARNING] manifest has no description, license, license-file, documentation, homepage or repository
+  |
+  = [NOTE] see https://doc.rust-lang.org/cargo/reference/manifest.html#package-metadata for more info
+[PACKAGING] foo v0.0.1 ([ROOT]/foo)
+[PACKAGED] 4 files, [FILE_SIZE]B ([FILE_SIZE]B compressed)
+[VERIFYING] foo v0.0.1 ([ROOT]/foo)
+[COMPILING] foo v0.0.1 ([ROOT]/foo/target/package/foo-0.0.1)
+[FINISHED] `dev` profile [unoptimized + debuginfo] target(s) in [ELAPSED]s
+
+"#]])
+        .run();
+
+    // Verify CACHEDIR.TAG exists in target (which excludes target/ and all subdirectories)
+    let cachedir_tag = p.root().join("target/CACHEDIR.TAG");
+    assert!(
+        cachedir_tag.exists(),
+        "CACHEDIR.TAG should exist in target directory to exclude it from backups"
+    );
+}