diff --git a/main.go b/main.go
index 32449a8..a9a9b76 100644
--- a/main.go
+++ b/main.go
@@ -318,6 +318,16 @@ func mainErr(args []string) error {
 		if err := f.Close(); err != nil {
 			return err
 		}
+		anyPrivate := false
+		for path := range listedPackages {
+			if isPrivate(path) {
+				anyPrivate = true
+				break
+			}
+		}
+		if !anyPrivate {
+			return fmt.Errorf("GOPRIVATE %q does not match any packages to be built", envGoPrivate)
+		}
 
 		execPath, err := os.Executable()
 		if err != nil {
@@ -564,18 +574,18 @@ func transformCompile(args []string) ([]string, error) {
 	return append(flags, newPaths...), nil
 }
 
-// isPrivate checks if GOPRIVATE matches pkgPath.
+// isPrivate checks if GOPRIVATE matches path.
 //
 // To allow using garble without GOPRIVATE for standalone main packages, it will
 // default to not matching standard library packages.
-func isPrivate(pkgPath string) bool {
-	if pkgPath == "main" || strings.HasPrefix(pkgPath, "plugin/unnamed") {
+func isPrivate(path string) bool {
+	if path == "main" || path == "command-line-arguments" || strings.HasPrefix(path, "plugin/unnamed") {
 		// TODO: why don't we see the full package path for main
 		// packages? The linker has it at the top of -importcfg, but not
 		// the compiler.
 		return true
 	}
-	return GlobsMatchPath(envGoPrivate, pkgPath)
+	return GlobsMatchPath(envGoPrivate, path)
 }
 
 func readBuildIDs(flags []string) error {
diff --git a/testdata/scripts/goprivate.txt b/testdata/scripts/goprivate.txt
new file mode 100644
index 0000000..599d5fb
--- /dev/null
+++ b/testdata/scripts/goprivate.txt
@@ -0,0 +1,16 @@
+env GOPRIVATE=match-absolutely/nothing
+! garble build -o bin ./standalone
+stderr 'does not match any packages'
+
+[short] stop
+
+# TODO: https://github.com/mvdan/garble/issues/108
+# env GOPRIVATE='*'
+# garble build  -o bin ./standalone
+
+-- go.mod --
+module test/main
+-- standalone/main.go --
+package main
+
+func main() {}