diff --git a/.grant.yaml b/.grant.yaml
index 323759da057..a5b44bedef3 100644
--- a/.grant.yaml
+++ b/.grant.yaml
@@ -9,3 +9,22 @@ allow:
   - BSD-3-Clause
   - ISC
 
+# Base OS packages of upstream container images that gh-aw executes (Alpine
+# variants of the MCP server and runtime images). These packages ship with every
+# Alpine base image, are never linked into or redistributed with gh-aw, and are
+# therefore accepted as a documented policy exception. The allowlist above still
+# applies to every other package in those images.
+ignore-packages:
+  - alpine-baselayout
+  - alpine-baselayout-data
+  - apk-tools
+  - busybox
+  - busybox-binsh
+  - ca-certificates
+  - ca-certificates-bundle
+  - libapk
+  - musl-utils
+  - scanelf
+  - ssl_client
+  - zlib
+
diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
index a6fd632ae4f..0c1e32ddf85 100644
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@@ -407,6 +407,10 @@ The following licenses are **not allowed** as they conflict with our MIT license
 - **SSPL** - Server Side Public License with restrictive requirements
 - **Proprietary/Commercial** - Closed-source licenses requiring payment or special terms
 
+### Container Base OS Packages
+
+The license policy in `.grant.yaml` is also applied to the container images referenced by compiled workflows (`gh aw compile --grant`). Base OS packages that ship with the Alpine base image (`busybox`, `apk-tools`, `alpine-baselayout`, `musl-utils`, `scanelf`, `ssl_client`, `ca-certificates`, `zlib`, and their variants) are listed under `ignore-packages` as a documented exception: they are executed as part of a third-party image, never linked into or redistributed with gh-aw, and cannot be changed without replacing the upstream image. Every other package in those images is still evaluated against the allowlist above.
+
 ### Before Adding a Dependency
 
 GitHub Copilot Agent automatically checks licenses when adding dependencies. However, if you're evaluating a dependency: