diff --git a/CHANGELOG.md b/CHANGELOG.md
index 05973e2be..8ca7287c1 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,5 +1,6 @@
 # Changelog
 
+- **Fixed** Broad workspace globs no longer discover and run package scripts inside `node_modules` ([#539](https://github.com/voidzero-dev/vite-task/pull/539)).
 - **Fixed** An issue where Bun tasks on macOS did not rerun when files they read, wrote, or listed changed ([#532](https://github.com/voidzero-dev/vite-task/issues/532), [#542](https://github.com/voidzero-dev/vite-task/pull/542)).
 - **Improved** Windows file-access tracking now uses sparse temporary backing files where supported, avoiding upfront allocation of the full backing file on disk ([#524](https://github.com/voidzero-dev/vite-task/pull/524)).
 - **Fixed** Automatic file-access tracking on Linux now works in containers and Kubernetes runners with limited `/dev/shm` space ([#353](https://github.com/voidzero-dev/vite-task/issues/353), [#523](https://github.com/voidzero-dev/vite-task/pull/523)).
diff --git a/crates/vite_workspace/src/lib.rs b/crates/vite_workspace/src/lib.rs
index 3b22d8bc9..8a1e4cd9c 100644
--- a/crates/vite_workspace/src/lib.rs
+++ b/crates/vite_workspace/src/lib.rs
@@ -13,7 +13,10 @@ use vec1::smallvec_v1::SmallVec1;
 use vite_glob::path::PathGlobSet;
 use vite_path::{AbsolutePath, AbsolutePathBuf, RelativePathBuf};
 use vite_str::Str;
-use wax::{Glob, walk::Entry as _};
+use wax::{
+    Glob,
+    walk::{Entry as _, FileIterator as _},
+};
 
 pub use crate::{
     error::Error,
@@ -112,7 +115,9 @@ impl WorkspaceMemberGlobs {
         // TODO: parallelize this
         for inclusion in inclusions {
             let glob = Glob::new(&inclusion)?;
-            for entry in glob.walk(workspace_root.as_path().to_path_buf()) {
+            for entry in
+                glob.walk(workspace_root.as_path().to_path_buf()).not("**/node_modules/**")?
+            {
                 let Ok(entry) = entry else {
                     continue;
                 };
@@ -572,6 +577,30 @@ mod tests {
         assert!(!found_excluded, "Should not have found excluded package");
     }
 
+    #[test]
+    fn test_get_package_graph_workspace_ignores_node_modules() {
+        let temp_dir = TempDir::new().unwrap();
+        let temp_dir_path = AbsolutePath::new(temp_dir.path()).unwrap();
+        fs::write(
+            temp_dir_path.join("package.json"),
+            r#"{"name":"root","workspaces":["samples/**"]}"#,
+        )
+        .unwrap();
+        fs::create_dir_all(temp_dir_path.join("samples/app/node_modules/dependency")).unwrap();
+        fs::write(temp_dir_path.join("samples/app/package.json"), r#"{"name":"app"}"#).unwrap();
+        fs::write(
+            temp_dir_path.join("samples/app/node_modules/dependency/package.json"),
+            r#"{"name":"dependency"}"#,
+        )
+        .unwrap();
+
+        let graph = discover_package_graph(temp_dir_path).unwrap();
+        let package_names: HashSet<_> =
+            graph.node_weights().map(|package| package.package_json.name.as_str()).collect();
+
+        assert_eq!(package_names, HashSet::from_iter(["root", "app"]));
+    }
+
     #[test]
     fn test_get_package_graph_workspace_work_with_last_match_wins() {
         let temp_dir = TempDir::new().unwrap();