diff --git a/conformance/tests/l0-static/egress-paths-selected-by-rules/check.sh b/conformance/tests/l0-static/egress-paths-selected-by-rules/check.sh
index 87986c1..a1d5d66 100755
--- a/conformance/tests/l0-static/egress-paths-selected-by-rules/check.sh
+++ b/conformance/tests/l0-static/egress-paths-selected-by-rules/check.sh
@@ -140,8 +140,16 @@ def docs(path: Path):
         return []
 
 
+# Skip dot-DIRECTORIES (.git, .claude, .cache) while still matching dot-FILES such as
+# .sops.yaml. A bare rglob from ROOT also descends into NESTED WORKTREES —
+# .claude/worktrees/agent-*/ created for isolated agent runs — which made this check see
+# 5 CiliumEgressGatewayPolicy objects instead of the 1 authored, failing R-NET-04 for a
+# reason that has nothing to do with egress. .claude/ is gitignored (.gitignore:43), so
+# nothing under it is part of the authored surface by definition.
 TRACKED_YAML = sorted(p for p in ROOT.rglob("*.yaml")
-                      if ".git" not in p.parts and "_artifacts" not in p.parts)
+                      if "_artifacts" not in p.parts
+                      and not any(part.startswith(".")
+                                  for part in p.relative_to(ROOT).parent.parts))
 SCHEMA = ROOT / "schemas" / "servicedefinition.schema.json"
 RENDER = ROOT / "catalog" / "render.py"
 VPN_ROLE = ROOT / "infra" / "ansible" / "roles" / "vpn_egress_gateway"