diff --git a/.changeset/patch-grant-license-exceptions-gh-aw-mcpg.md b/.changeset/patch-grant-license-exceptions-gh-aw-mcpg.md
new file mode 100644
index 00000000000..664e0c4d30e
--- /dev/null
+++ b/.changeset/patch-grant-license-exceptions-gh-aw-mcpg.md
@@ -0,0 +1,5 @@
+---
+"gh-aw": patch
+---
+
+Expand `.grant.yaml` with additional Alpine base/runtime package exceptions used by `ghcr.io/github/gh-aw-mcpg:v0.4.9` so Grant no longer reports the 59 known license-policy violations for that image's upstream OS/runtime stack.
diff --git a/.grant.yaml b/.grant.yaml
index 17e98e0a166..bfabb7af1ab 100644
--- a/.grant.yaml
+++ b/.grant.yaml
@@ -21,20 +21,63 @@ ignore-packages:
   - alpine-baselayout
   - alpine-baselayout-data
   - apk-tools
+  - bash
   - busybox
   - busybox-binsh
   - ca-certificates
   - ca-certificates-bundle
+  - catatonit
+  - crun
+  - fuse-common
+  - fuse-overlayfs
+  - fuse3
+  - fuse3-libs
+  - gdbm
+  - glib
+  - gmp
+  - gnupg-dirmngr
+  - gnupg-gpgconf
+  - gnupg-keyboxd
+  - gnutls
+  - gpg
+  - gpg-agent
+  - gpgme
+  - gpgsm
   - git
   - git-init-template
   - libapk
+  - libassuan
+  - libblkid
+  - libbz2
+  - libcap2
   - libcurl
   - libgcc
+  - libgcrypt
+  - libgpg-error
   - libidn2
+  - libintl
+  - libksba
+  - libldap
+  - libmd
+  - libmnl
+  - libmount
+  - libncursesw
+  - libnftnl
+  - libsasl
+  - libseccomp
   - libstdc++
+  - libtasn1
   - libunistring
   - musl-utils
+  - ncurses-terminfo-base
+  - nettle
+  - nftables
+  - npth
+  - passt
+  - pinentry
+  - readline
   - scanelf
+  - sqlite-libs
   - ssl_client
   - zlib
   - zstd-libs
@@ -62,4 +105,3 @@ ignore-packages:
   - spdx-license-ids
   - tar
   - yallist
-