diff --git a/templates/gitattributes b/templates/gitattributes
index 226c36e..700b6eb 100644
--- a/templates/gitattributes
+++ b/templates/gitattributes
@@ -1,17 +1,14 @@
-# --- Encryption Rules for Genomes ---
-# These directories are stored as encrypted AES-256 blobs on the remote server.
-# They require git-crypt and the specific genome key to be readable.
-
-raw/private/** filter=git-crypt diff=git-crypt
-wiki/private/** filter=git-crypt diff=git-crypt
-
-# --- Binary Integrity ---
-# Prevent line-ending conversion for encrypted files to avoid corruption.
-raw/private/** -text
-wiki/private/** -text
-
 # --- Standard Text Configuration ---
 *.md            text eol=lf
 *.sh            text eol=lf
 *.env           text eol=lf
 Makefile        text eol=lf
+
+# --- Encryption Rules ---
+# MUST come after text rules: in .gitattributes the last matching rule wins per attribute.
+# Placing **/private/** here ensures -text overrides the *.md text=lf rule above,
+# preventing EOL conversion from corrupting AES-256 encrypted blobs.
+#
+# **/private/** catches any private/ directory at any depth in the repo,
+# including directories created at runtime by the LLM agent.
+**/private/**   filter=git-crypt diff=git-crypt -text