diff --git a/.gitattributes b/.gitattributes
index 62da761..a6266de 100644
--- a/.gitattributes
+++ b/.gitattributes
@@ -1,4 +1,20 @@
-# Shell scripts must keep LF endings. core.autocrlf=true on Windows would
-# otherwise check them out CRLF, which a strict POSIX sh (dash, CI containers)
-# rejects at the shebang.
+# Line endings: LF in the repository and in every working tree, on every OS.
+#
+# This file is the policy, not each machine's git config. Git for Windows installs
+# with core.autocrlf=true, which checks text out as CRLF; an attribute here beats
+# that setting, so a fresh clone gets LF regardless of how its machine is set up.
+#
+# It matters beyond tidiness. tools/branding-sites.tsv is read line by line with
+# `read`, and under CRLF every row's last field gained a trailing 
 - so the
+# branding checker reported all 29 sites as missing on Windows while passing on the
+# Linux CI runner. text=auto leaves genuinely binary files alone.
+* text=auto eol=lf
+
+# Shell scripts are pinned explicitly as well: a strict POSIX sh (dash, CI
+# containers) rejects a CRLF shebang outright rather than misbehaving quietly.
 *.sh text eol=lf
+
+# The exception. cmd.exe misparses LF-only batch files around labels and long
+# lines, so these alone are checked out CRLF. The repository copy is still LF.
+*.bat text eol=crlf
+*.cmd text eol=crlf