diff --git a/scripts/package-mac-dmg.cjs b/scripts/package-mac-dmg.cjs
index cca36c1..5d8e0d0 100644
--- a/scripts/package-mac-dmg.cjs
+++ b/scripts/package-mac-dmg.cjs
@@ -197,7 +197,7 @@ async function main() {
       overwrite: true,
       prune: true,
       asar: false,
-      ignore: [IGNORE_NON_RUNTIME_ROOTS, /\.DS_Store$/, /\.log$/],
+      ignore: [IGNORE_NON_RUNTIME_ROOTS, /\/AGENTS\.md$/, /\.DS_Store$/, /\.log$/],
       extendInfo: {
         CFBundleDisplayName: PRODUCT,
         CFBundleName: PRODUCT,
diff --git a/test/desktop.mjs b/test/desktop.mjs
index a383f64..8d671d2 100644
--- a/test/desktop.mjs
+++ b/test/desktop.mjs
@@ -235,6 +235,7 @@ test("release packaging is fail-closed and records stable product identity", asy
   assert.match(source, /verifyApp\(extractedApp, true\)/, "the extracted updater app passes signature, ticket, and Gatekeeper checks");
   assert.match(source, /"--sign", "-", candidate/);
   assert.match(source, /Library\/LaunchAgents/, "release packaging rejects legacy background-agent payloads");
+  assert.match(source, /\/AGENTS\\\.md\$/, "release packaging excludes dependency instruction files before signing");
   assert.match(source, /Library\/Application Support\/1Helm/);
   assert.match(source, /installProductIcon/);
   assert.match(source, /desktop", "icons", "1helm-macos-app-logo\.jpg/);