diff --git a/.trivyignore b/.trivyignore
index 1defffe..07f39fd 100644
--- a/.trivyignore
+++ b/.trivyignore
@@ -1,3 +1,5 @@
 # CVEs baked into the ocis-workflows binary (Go/npm dependencies). Unfixable by this
 # repo — requires an upstream owncloud/ocis-workflows fix. Add entries only when a
 # CVE is disclosed that upstream hasn't patched yet.
+#
+# (throwaway line for a branch-protection gate test - this PR will be closed)