diff --git a/.gitignore b/.gitignore
index 67b8f84..9210f06 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1,8 +1,11 @@
 node_modules/
 dist/
 # Locally-built @metazla/filename-tools tarball (vendored file: dep; rebuilt from
-# packages/filename-tool — see Dockerfile note). Build artifact, not source.
-vendor/
+# packages/filename-tool — see Dockerfile note). The tarball itself MUST be
+# committed: the Dockerfile `COPY vendor/` needs it at build time, and CI has no
+# other source for it. Ignore everything else under vendor/.
+vendor/*
+!vendor/filename-tools.tgz
 *.log
 .env
 .DS_Store
diff --git a/vendor/filename-tools.tgz b/vendor/filename-tools.tgz
new file mode 100644
index 0000000..d037f73
Binary files /dev/null and b/vendor/filename-tools.tgz differ