diff --git a/scripts/check-issue-refs.sh b/scripts/check-issue-refs.sh
index 7a30b54c..c79b6105 100755
--- a/scripts/check-issue-refs.sh
+++ b/scripts/check-issue-refs.sh
@@ -11,8 +11,10 @@
 # Emits a CI error annotation per hit, exits 1 if any hit is found. Its own
 # required CI job (branch protection) — a hit blocks merge.
 #
-# Scope: every tracked `*.rs *.nix *.js *.ts *.tsx *.css *.html *.md`. Two
-# alternatives: a hash, 2-5 digits, then non-alphanumeric-or-EOL (skips
+# Scope: every tracked `*.rs *.nix *.js *.ts *.tsx *.css *.html *.md *.yml
+# *.yaml`. CI workflow files (`.forgejo/workflows/*.yml`) are explicitly in
+# scope: a step comment is still a comment. The pattern matches a hash,
+# 2-5 digits, then a non-alphanumeric char or end-of-line (skips
 # letter-bearing hex colours and digit-runs-then-letter, e.g. `#24h`;
 # residual: a pure-numeric short hex trips it, write the six-digit form to
 # dodge); or an `/issues/N` path segment, catching a full link via
@@ -32,6 +34,7 @@ pattern='#[0-9]{2,5}([^0-9a-zA-Z]|$)|/issues/[0-9]+([^0-9a-zA-Z]|$)'
 # (legitimate non-tracker hit; see the header).
 hits="$(
   git ls-files -z '*.rs' '*.nix' '*.js' '*.ts' '*.tsx' '*.css' '*.html' '*.md' \
+    '*.yml' '*.yaml' \
     | xargs -0 -r grep -nE "$pattern" /dev/null 2>/dev/null \
     | grep -v 'lint:allow' || true
 )"