diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index 6571b71..ba6c7cb 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -6,8 +6,9 @@ name: CodeQL
 #   - `auto` — in-repo detection: always includes `go`; adds
 #     `javascript-typescript` when a `package.json` exists OR any
 #     `.js` / `.jsx` / `.mjs` / `.cjs` / `.ts` / `.tsx` / `.mts` / `.cts`
-#     source is present in the first 4 levels of the tree (ignoring
-#     `node_modules/` and `vendor/`). A `package.json` is NOT required —
+#     source is present in the first 8 levels of the tree (ignoring
+#     `node_modules/`, `vendor/` and `.git/`). A `package.json` is NOT
+#     required —
 #     repos with a hand-written plain-JS frontend still get scanned. This
 #     is the preferred value for Go repos since it picks up JS/TS
 #     automatically.