diff --git a/core/modules/system/src/Tests/System/HtaccessTest.php b/core/modules/system/src/Tests/System/HtaccessTest.php
index 94bfe20..afc6e7b 100644
--- a/core/modules/system/src/Tests/System/HtaccessTest.php
+++ b/core/modules/system/src/Tests/System/HtaccessTest.php
@@ -44,6 +44,10 @@ protected function getProtectedFiles() {
       $file_paths[] = "$path/access_test.$file_ext";
     }
 
+    // Ensure composer.json and composer.lock cannot be accessed.
+    $file_paths[] = 'composer.json';
+    $file_paths[] = 'composer.lock';
+
     return $file_paths;
   }