diff --git a/.gitattributes b/.gitattributes
new file mode 100644
index 0000000..60aab31
--- /dev/null
+++ b/.gitattributes
@@ -0,0 +1,11 @@
+# Forensic fixtures are byte-exact evidence: a test asserts on the exact bytes
+# a real macOS volume contained. Git's text/binary autodetection only scans the
+# first 8000 bytes for NUL, so a compressed payload whose first NUL falls later
+# is classified as text and gets its LF bytes rewritten to CRLF on checkout
+# under core.autocrlf=true -- the default on GitHub's windows-latest runners.
+# That silently corrupted both the .expected files and several .rsrc/.payload
+# inputs, which is why the decmpfs tests failed only on Windows.
+#
+# Never let git translate anything under a data directory.
+tests/data/** -text
+fuzz/corpus/** -text
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index c0ba617..88532ac 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -18,7 +18,7 @@ jobs:
   # and MSRV is read from rust-version. Anything that needed configuring would be
   # a behaviour change smuggled in by an adoption PR, so there is nothing here.
   ci:
-    uses: SecurityRonin/fleet-ci/.github/workflows/rust-ci.yml@a62ab10603151071744cec0b4e3638aa6406d4e4
+    uses: SecurityRonin/fleet-ci/.github/workflows/rust-ci.yml@f9802dca64a95eb881fd05dd3f4f16e53b97f2b3
     with:
       # CARRIED ACROSS. The replaced workflow gated on --fail-under-functions
       # 100 (functions, no line gate). The shared default is 100% per LINE — a