diff --git a/.gitattributes b/.gitattributes
new file mode 100644
index 0000000..585c23e
--- /dev/null
+++ b/.gitattributes
@@ -0,0 +1,24 @@
+# Normalize line endings. Unix artifacts MUST stay LF: a shell script or
+# desktop/udev/spec file checked out with CRLF (e.g. on Windows with
+# core.autocrlf=true) fails to run on Linux — `#!/usr/bin/env bash\r` is a
+# "bad interpreter" error, and .desktop/.rules parsers choke on trailing \r.
+* text=auto eol=lf
+
+*.sh          text eol=lf
+*.desktop     text eol=lf
+*.rules       text eol=lf
+*.spec        text eol=lf
+*.xml         text eol=lf
+control.in    text eol=lf
+*.js          text eol=lf
+*.mjs         text eol=lf
+*.cjs         text eol=lf
+*.json        text eol=lf
+*.md          text eol=lf
+launcher.sh   text eol=lf
+
+# Binary assets must never be line-ending converted.
+*.png         binary
+*.ico         binary
+*.gz          binary
+*.traineddata binary
diff --git a/tests/unit/packaging-linux.test.js b/tests/unit/packaging-linux.test.js
index e988bfc..c3a93fb 100644
--- a/tests/unit/packaging-linux.test.js
+++ b/tests/unit/packaging-linux.test.js
@@ -6,7 +6,8 @@ const fs = require('node:fs');
 const path = require('node:path');
 
 const ROOT = path.resolve(__dirname, '..', '..');
-const read = (rel) => fs.readFileSync(path.join(ROOT, rel), 'utf8');
+// Strip CR so /^...$/m assertions are robust to CRLF checkouts on Windows CI.
+const read = (rel) => fs.readFileSync(path.join(ROOT, rel), 'utf8').replace(/\r\n/g, '\n');
 const exists = (rel) => fs.existsSync(path.join(ROOT, rel));
 
 // These are structural checks that run in the normal (cross-platform) unit
diff --git a/tests/unit/wayland-honesty.test.js b/tests/unit/wayland-honesty.test.js
index f01518a..b58fc27 100644
--- a/tests/unit/wayland-honesty.test.js
+++ b/tests/unit/wayland-honesty.test.js
@@ -9,7 +9,8 @@ const { chooseCaptureTrigger, detectLinuxCapabilities } = require('../../app/pla
 const platform = require('../../app/platform');
 
 const ROOT = path.resolve(__dirname, '..', '..');
-const read = (rel) => fs.readFileSync(path.join(ROOT, rel), 'utf8');
+// Strip CR so assertions are robust to CRLF checkouts on Windows CI.
+const read = (rel) => fs.readFileSync(path.join(ROOT, rel), 'utf8').replace(/\r\n/g, '\n');
 const exists = (rel) => fs.existsSync(path.join(ROOT, rel));
 
 // ---- honest trigger decisions ----------------------------------------------