diff --git a/mypy-stubtest.ini b/mypy-stubtest.ini
index a8022cbc..6f026654 100644
--- a/mypy-stubtest.ini
+++ b/mypy-stubtest.ini
@@ -14,3 +14,15 @@ disallow_any_explicit = True
 # don't follow import pygit2 from _pygit2.pyi, we only want to check the pyi file.
 [mypy-pygit2]
 follow_imports = skip
+
+# The stub imports names from the package (pygit2.Index) and from the cffi
+# binding stub, so those modules enter the build even though stubtest only
+# reads _pygit2.pyi. disallow_any_explicit above is about the stub under test;
+# applying it to the rest of the package is what stopped stubtest running at
+# all once pygit2/_libgit2/ffi.pyi arrived.
+[mypy-pygit2.*]
+disallow_any_explicit = False
+
+# ... except the stub under test, which is the point of the setting.
+[mypy-pygit2._pygit2]
+disallow_any_explicit = True