diff --git a/.github/workflows/rat.yml b/.github/workflows/rat.yml
index ae87cdf8..6b987ff1 100644
--- a/.github/workflows/rat.yml
+++ b/.github/workflows/rat.yml
@@ -75,6 +75,12 @@ jobs:
           # off the report so contributors get the offending file list, not a
           # Java stack trace. --input-exclude-parsed-scm GIT honours
           # .gitignore; --input-exclude-std GIT/HIDDEN_DIR skips VCS metadata.
+          # --input-include '**/.gitignore' overrides those exclusions for the
+          # tracked .gitignore files themselves (parsed-scm GIT otherwise
+          # self-excludes the ignore files), so RAT enforces the ASF header
+          # that tools/dev/add-license-headers.py stamps into them. (.git/ is
+          # still skipped as a hidden dir; .apache-magpie-overrides/.gitignore
+          # stays excluded under its hidden dir.)
           jar="${RUNNER_TEMP}/apache-rat-${RAT_VERSION}/apache-rat-${RAT_VERSION}.jar"
           report="${RUNNER_TEMP}/rat-report.txt"
           stderr_log="${RUNNER_TEMP}/rat-stderr.log"
@@ -82,6 +88,7 @@ jobs:
             --input-exclude-std GIT HIDDEN_DIR \
             --input-exclude-parsed-scm GIT \
             --input-exclude-file .rat-excludes \
+            --input-include '**/.gitignore' \
             --output-style unapproved-licenses \
             --output-file "${report}" \
             . 2>"${stderr_log}" && rc=0 || rc=$?