diff --git a/CHANGELOG.md b/CHANGELOG.md
index a76e814d..4ddcc842 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,5 +1,6 @@
 # Changelog
 
+- **Fixed** Broad workspace globs no longer discover and run package scripts inside `node_modules` ([#539](https://github.com/voidzero-dev/vite-task/pull/539)).
 - **Fixed** The task cache now supports much larger automatically tracked input sets without hitting wincode's default 4 MiB sequence preallocation limit ([#554](https://github.com/voidzero-dev/vite-task/pull/554)).
 - **Fixed** npm workspace patterns beginning with `./` now discover matching packages correctly ([vite-plus#2201](https://github.com/voidzero-dev/vite-plus/issues/2201), [#547](https://github.com/voidzero-dev/vite-task/pull/547)).
 - **Fixed** Failures while forwarding output from a started task process no longer incorrectly say the process failed to spawn ([#506](https://github.com/voidzero-dev/vite-task/issues/506)).
diff --git a/crates/vite_workspace/src/lib.rs b/crates/vite_workspace/src/lib.rs
index ba8e9823..66d81507 100644
--- a/crates/vite_workspace/src/lib.rs
+++ b/crates/vite_workspace/src/lib.rs
@@ -13,7 +13,10 @@ use vec1::smallvec_v1::SmallVec1;
 use vite_glob::path::PathGlobSet;
 use vite_path::{AbsolutePath, AbsolutePathBuf, RelativePathBuf};
 use vite_str::Str;
-use wax::{Glob, walk::Entry as _};
+use wax::{
+    Glob,
+    walk::{Entry as _, FileIterator as _},
+};
 
 pub use crate::{
     error::Error,
@@ -134,7 +137,9 @@ impl WorkspaceMemberGlobs {
         // TODO: parallelize this
         for inclusion in inclusions {
             let glob = Glob::new(&inclusion)?;
-            for entry in glob.walk(workspace_root.as_path().to_path_buf()) {
+            for entry in
+                glob.walk(workspace_root.as_path().to_path_buf()).not("**/node_modules/**")?
+            {
                 let Ok(entry) = entry else {
                     continue;
                 };
@@ -594,6 +599,30 @@ mod tests {
         assert!(!found_excluded, "Should not have found excluded package");
     }
 
+    #[test]
+    fn test_get_package_graph_workspace_ignores_node_modules() {
+        let temp_dir = TempDir::new().unwrap();
+        let temp_dir_path = AbsolutePath::new(temp_dir.path()).unwrap();
+        fs::write(
+            temp_dir_path.join("package.json"),
+            r#"{"name":"root","workspaces":["samples/**"]}"#,
+        )
+        .unwrap();
+        fs::create_dir_all(temp_dir_path.join("samples/app/node_modules/dependency")).unwrap();
+        fs::write(temp_dir_path.join("samples/app/package.json"), r#"{"name":"app"}"#).unwrap();
+        fs::write(
+            temp_dir_path.join("samples/app/node_modules/dependency/package.json"),
+            r#"{"name":"dependency"}"#,
+        )
+        .unwrap();
+
+        let graph = discover_package_graph(temp_dir_path).unwrap();
+        let package_names: HashSet<_> =
+            graph.node_weights().map(|package| package.package_json.name.as_str()).collect();
+
+        assert_eq!(package_names, HashSet::from_iter(["root", "app"]));
+    }
+
     #[test]
     fn test_get_package_graph_workspace_work_with_last_match_wins() {
         let temp_dir = TempDir::new().unwrap();