diff --git a/.github/workflows/code-scan.yaml b/.github/workflows/code-scan.yaml
index f605f19..dd0d128 100644
--- a/.github/workflows/code-scan.yaml
+++ b/.github/workflows/code-scan.yaml
@@ -66,7 +66,9 @@ jobs:
           veracode-api-key: ${{ secrets.VERACODE_API_KEY }}
           rl-scanner: false
           # vendor/openssl-src/openssl/external is build-only Perl bundled by OpenSSL (GPL-1.0), not shipped in any built artifact
-          exclude-dirs: .vbuild-actions vendor/openssl-src/openssl/external
+          # scripts/ is maintainer tooling (docs archiving, release checks): it is in the sdist's source tree
+          # but never installed or run by a build or by eqty_sdk
+          exclude-dirs: .vbuild-actions vendor/openssl-src/openssl/external scripts
 
   # Main branch scans: Full attestation in TEE
   security-scan-main:
@@ -127,4 +129,6 @@ jobs:
           veracode-api-key: ${{ secrets.VERACODE_API_KEY }}
           rl-scanner: false
           # vendor/openssl-src/openssl/external is build-only Perl bundled by OpenSSL (GPL-1.0), not shipped in any built artifact
-          exclude-dirs: .vbuild-actions vendor/openssl-src/openssl/external
+          # scripts/ is maintainer tooling (docs archiving, release checks): it is in the sdist's source tree
+          # but never installed or run by a build or by eqty_sdk
+          exclude-dirs: .vbuild-actions vendor/openssl-src/openssl/external scripts