diff --git a/.agents/state.md b/.agents/state.md
index ce41eef8..45adf585 100644
--- a/.agents/state.md
+++ b/.agents/state.md
@@ -2,6 +2,23 @@
 
 ## Now
 
+- **Windows CI red since `f5cf464` is repaired by `.gitattributes`**
+  (2026-09-29, owner-directed fix on `main`): every completed CI run from
+  `f5cf464` through `4cf4d13` failed `Test · Windows` on two
+  `AurGeneratorTests` golden checks. Root cause: the AUR generator hashes
+  `packaging/linux/am-configurator.desktop` and
+  `am_configurator/data/60-am-neon-80.rules` as working-tree bytes, and the
+  Windows runner checked them out CRLF. `.gitattributes` now pins `*.desktop`,
+  `*.rules`, `*.sh`, and `packaging/linux/AppRun` to LF. The FFmpeg-removal
+  guard in `tests/test_packaging.py` no longer asserts `.gitattributes` is
+  absent; its token guard over that file still bites (proven by reintroducing
+  the token). Reproduced and proven locally in a `core.autocrlf=true` clone
+  (2 failures without the file, 21/21 with it) and confirmed on the real
+  runner: CI run 36582902438 on PR #3 at `02194cf` passed `Test · Windows` and
+  every other check. The AppImage and installer builds were never affected.
+  `v2/openkeeb` carries the same defect and is not covered by CI push
+  triggers.
+
 - **0.1.68 is published** (2026-08-08): tag `v0.1.68` at `cdcf841`, signed
   release run 31240024617 fully green (Release identity, signed Windows
   installer, signed macOS installer, Linux AppImage, Publish), GitHub Release
diff --git a/.gitattributes b/.gitattributes
new file mode 100644
index 00000000..daf6d8dc
--- /dev/null
+++ b/.gitattributes
@@ -0,0 +1,8 @@
+# Files that ship to Linux are hashed and copied byte-for-byte by the package
+# generators in build_tools/package_managers. A CRLF checkout (the Windows
+# default) changes their digests and would put CRLF files in a Linux package,
+# so they stay LF on every platform.
+*.desktop text eol=lf
+*.rules text eol=lf
+*.sh text eol=lf
+packaging/linux/AppRun text eol=lf
diff --git a/tests/test_packaging.py b/tests/test_packaging.py
index 9349d2dc..06d3ac2c 100644
--- a/tests/test_packaging.py
+++ b/tests/test_packaging.py
@@ -1243,7 +1243,6 @@ def test_native_bundle_and_build_surface_have_no_retired_video_stack(self) -> No
         self.assertIn("codesign --force --sign -", macos)
 
         removed_paths = (
-            ROOT / ".gitattributes",
             ROOT / "am_configurator" / f"{retired_tool}_runtime.py",
             ROOT / "am_configurator" / "media.py",
             ROOT / "build_tools" / f"{retired_tool}_bundle.py",