diff --git a/internal/scan/provider.go b/internal/scan/provider.go
index 9690530c..ec1a6d97 100644
--- a/internal/scan/provider.go
+++ b/internal/scan/provider.go
@@ -263,7 +263,6 @@ func (p *Provider) gitLs(ctx context.Context, args ...string) ([]string, error)
 	raw := strings.Split(strings.TrimRight(out, "\x00"), "\x00")
 	files := make([]string, 0, len(raw))
 	for _, f := range raw {
-		f = strings.TrimSpace(f)
 		if f != "" {
 			files = append(files, f)
 		}
diff --git a/internal/scan/provider_test.go b/internal/scan/provider_test.go
index 8cfeb5cc..4d4b77e0 100644
--- a/internal/scan/provider_test.go
+++ b/internal/scan/provider_test.go
@@ -10,6 +10,7 @@ import (
 	"os/exec"
 	"path/filepath"
 	"reflect"
+	"runtime"
 	"sort"
 	"strings"
 	"testing"
@@ -175,6 +176,32 @@ func TestProvider_Enumerate_FullRepo(t *testing.T) {
 	}
 }
 
+func TestProvider_Enumerate_PreservesWhitespacePaths(t *testing.T) {
+	if runtime.GOOS == "windows" {
+		t.Skip("Windows filenames cannot end with spaces")
+	}
+
+	repo := initTestRepo(t)
+	writeFile(t, repo, " leading.go", []byte("package leading\n"))
+	writeFile(t, repo, "trailing.go ", []byte("package trailing\n"))
+	gitCommit(t, repo, "add whitespace paths")
+
+	got, err := NewProvider(repo, nil, nil, 0).Enumerate(context.Background())
+	if err != nil {
+		t.Fatalf("Enumerate: %v", err)
+	}
+
+	paths := make([]string, 0, len(got))
+	for _, item := range got {
+		paths = append(paths, item.Path)
+	}
+	sort.Strings(paths)
+	want := []string{" leading.go", "trailing.go "}
+	if !reflect.DeepEqual(paths, want) {
+		t.Errorf("paths = %q, want %q", paths, want)
+	}
+}
+
 func TestProvider_Enumerate_NonGitDirectory(t *testing.T) {
 	// Plain temp dir — no `git init`. Walker fallback should kick in.
 	repo := t.TempDir()