diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 3fc71ce..2eee8a2 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -38,6 +38,11 @@ jobs:
           service_account: ${{ vars.DEPLOYER_SA_EMAIL }}
       - uses: google-github-actions/setup-gcloud@v2
 
+      # google-github-actions/auth writes gha-creds-*.json into the workspace; exclude it so
+      # goreleaser's clean-tree check does not fail with "git is in a dirty state".
+      - name: keep the tree clean for goreleaser
+        run: echo 'gha-creds-*.json' >> .git/info/exclude
+
       - name: build binaries + checksums + SBOM
         uses: goreleaser/goreleaser-action@v6
         with: