diff --git a/api/tests/test_guards_report.py b/api/tests/test_guards_report.py
index a8f8fa1..5aa8c5d 100644
--- a/api/tests/test_guards_report.py
+++ b/api/tests/test_guards_report.py
@@ -59,3 +59,8 @@ def test_render_splits_lane_and_grant_counts():
     assert "| compute-guard (Mind is the only door) | 0 | 0 | ✅ YES |" in md
     assert "| windy-git | bbbbbbb | 0 | 0 | clean ✅ |" in md
     assert "(job reality-check)" in md
+
+
+def test_windy_pro_root_env_example_is_grant_owned_but_not_the_account_servers():
+    assert gr.grant_owned("windy-pro", ".env.example", None, OWNED)
+    assert not gr.grant_owned("windy-pro", "account-server/.env.example", None, OWNED)
diff --git a/ci/grant-owned.yml b/ci/grant-owned.yml
index 4ae0378..91e7259 100644
--- a/ci/grant-owned.yml
+++ b/ci/grant-owned.yml
@@ -6,6 +6,10 @@ grant_owned:
     reason: "Windy Word desktop (Electron) + its release/installer builds: Grant's, built from the Mac mini."
     paths:
       - "src/client/desktop/*"
+      # ROOT .env.example only (exact path): documents the desktop app's BYOK dev
+      # fallback keys; the hub reads neither (8c, 09-23). account-server/.env.example
+      # is NOT matched and stays the hub lane's.
+      - ".env.example"
       - "installer-v2/*"
       - ".github/workflows/build-windows.yml"
       - ".github/workflows/release-mac.yml"