diff --git a/.github/workflows/actionlint.yml b/.github/workflows/actionlint.yml
index c0774356d..1bec23997 100644
--- a/.github/workflows/actionlint.yml
+++ b/.github/workflows/actionlint.yml
@@ -65,7 +65,9 @@ jobs:
           version: ${{ env.SHELLCHECK_VERSION }}
           # Exclude vendored third-party scripts (dotnet-install.sh is the
           # Microsoft .NET installer) and generated agent-template directories.
-          ignore_paths: dotnet-install.sh my-agent-0b2avt
+          ignore_paths: >-
+            */dotnet-install.sh
+            my-agent-0b2avt
           # Only fail CI on error-severity findings; warnings in our own
           # scripts are reported but do not block the build.
           severity: error
diff --git a/tests/test_actionlint_workflow.py b/tests/test_actionlint_workflow.py
new file mode 100644
index 000000000..90e2dd8c2
--- /dev/null
+++ b/tests/test_actionlint_workflow.py
@@ -0,0 +1,20 @@
+from __future__ import annotations
+
+from pathlib import Path
+
+import pytest
+import yaml
+
+pytestmark = pytest.mark.unit
+
+
+def test_actionlint_shellcheck_ignores_vendored_dotnet_script() -> None:
+    workflow_path = Path(__file__).resolve().parents[1] / ".github" / "workflows" / "actionlint.yml"
+    workflow = yaml.safe_load(workflow_path.read_text(encoding="utf-8"))
+
+    shellcheck_step = next(
+        step for step in workflow["jobs"]["actionlint"]["steps"] if step.get("name") == "Setup ShellCheck (pinned)"
+    )
+
+    ignore_paths = shellcheck_step["with"]["ignore_paths"].split()
+    assert "*/dotnet-install.sh" in ignore_paths