diff --git a/.gitignore b/.gitignore
index 6438c8e..6791537 100644
--- a/.gitignore
+++ b/.gitignore
@@ -4,7 +4,6 @@
 
 # Global build artifacts
 target/
-Cargo.lock
 
 # Global temporary and log files
 *.tmp
diff --git a/crates/xtask/src/main.rs b/crates/xtask/src/main.rs
index c7b97e8..8de0c8c 100644
--- a/crates/xtask/src/main.rs
+++ b/crates/xtask/src/main.rs
@@ -10547,7 +10547,6 @@ fn generate_full_gitignore() -> Result<String> {
 # Rust build artifacts
 ############################
 /target/
-Cargo.lock
 
 ############################
 # IDE & editor
@@ -10676,9 +10675,13 @@ fn generate_canonical_gitignore() -> Result<String> {
 
     // Define known ignorable patterns that should be included if they exist in the tree
     let ignorable_patterns = vec![
-        // Rust build artifacts
+        // Rust build artifacts. Cargo.lock is deliberately absent: this is a
+        // workspace with a COMMITTED lockfile, and ignoring a tracked file is
+        // inert for git but not for tools that match .gitignore patterns
+        // directly — osv-scanner skipped it and reported green having scanned
+        // nothing for months (#108). The entry was a default carried over from
+        // the library case, where Cargo.lock genuinely is not committed.
         ("target", "/target/"),
-        ("Cargo.lock", "Cargo.lock"),
         // IDE & editor
         (".vscode", ".vscode/"),
         (".idea", ".idea/"),