diff --git a/.github/workflows/pr-require-checks.yml b/.github/workflows/pr-require-checks.yml
index e2083c3ad25..6470b77c16f 100644
--- a/.github/workflows/pr-require-checks.yml
+++ b/.github/workflows/pr-require-checks.yml
@@ -1504,6 +1504,8 @@ jobs:
         with:
           files: ${{ steps.changed_shell.outputs.files }}
           rcfile: .shellcheckrc
+          # Plugin-owned guardrails git-hook copies, linted at their plugins/guardrails sources.
+          exclude: .githooks/guardrails/
 
       - name: Aggregate hygiene results
         if: always()
diff --git a/scripts/check-affected.sh b/scripts/check-affected.sh
index f94893feb0d..16c989236a1 100755
--- a/scripts/check-affected.sh
+++ b/scripts/check-affected.sh
@@ -242,6 +242,9 @@ declare -a md=() sh=() py=() shebang=() plugins=()
 skill_touched=0
 for f in ${changed[@]+"${changed[@]}"}; do
   case "$f" in
+  # Plugin-owned guardrails git-hook copies, linted at their plugins/guardrails
+  # sources; the workflow's ShellCheck step excludes .githooks/guardrails/ too.
+  .githooks/guardrails/*.sh | .githooks/guardrails/*.bash) ;;
   *.md) md+=("$f") ;;
   *.sh | *.bash) sh+=("$f") ;;
   *.py) py+=("$f") ;;
diff --git a/scripts/check-affected.test.sh b/scripts/check-affected.test.sh
index 30708b93dc0..37e0cf5425b 100755
--- a/scripts/check-affected.test.sh
+++ b/scripts/check-affected.test.sh
@@ -329,7 +329,14 @@ if grep -q -- --rcfile <<<"$(shellcheck --help 2>&1)"; then
   run -- --uncommitted
   check "--uncommitted lints a changed shell file with the repository's .shellcheckrc" \
     '[[ $RC == 1 && $ERR == *"FAIL shellcheck"* && $ERR == *"SC2292"* && $ERR != *"unrecognized option"* ]]'
-  rm -f "$repo/.shellcheckrc" "$repo/lint-me.sh"
+  rm -f "$repo/lint-me.sh"
+  mkdir -p "$repo/.githooks/guardrails"
+  printf '#!/usr/bin/env bash\nif [ -n "${1:-}" ]; then echo hi; fi\n' >"$repo/.githooks/guardrails/copy.sh"
+  chmod +x "$repo/.githooks/guardrails/copy.sh"
+  run -- --uncommitted
+  check "--uncommitted leaves the plugin-owned .githooks/guardrails copies to the workflow's excluded lint" \
+    '[[ $RC == 0 && $ERR != *"FAIL shellcheck"* && $ERR == *"SKIP shellcheck (no changed shell)"* ]]'
+  rm -rf "$repo/.shellcheckrc" "$repo/.githooks"
 else
   ok "SKIP --uncommitted shellcheck case (no shellcheck with --rcfile here)"
 fi