diff --git a/.gitattributes b/.gitattributes
index fdf45b5..3ff368f 100644
--- a/.gitattributes
+++ b/.gitattributes
@@ -12,7 +12,6 @@
 *.opus filter=lfs diff=lfs merge=lfs -text
 *.mid filter=lfs diff=lfs merge=lfs -text
 *.midi filter=lfs diff=lfs merge=lfs -text
-*.mod filter=lfs diff=lfs merge=lfs -text
 *.s3m filter=lfs diff=lfs merge=lfs -text
 *.xm filter=lfs diff=lfs merge=lfs -text
 *.it filter=lfs diff=lfs merge=lfs -text
diff --git a/tools/check-gitattributes.sh b/tools/check-gitattributes.sh
new file mode 100755
index 0000000..2c14f82
--- /dev/null
+++ b/tools/check-gitattributes.sh
@@ -0,0 +1,43 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+repository=$(git rev-parse --show-toplevel)
+cd "${repository}"
+
+command -v git-lfs >/dev/null || {
+  echo "Git LFS is required for the attribute regression check" >&2
+  exit 1
+}
+
+before=$(git status --porcelain=v1 --untracked-files=all)
+if [[ -n ${before} ]]; then
+  echo "attribute regression check requires a clean checkout before Git LFS initialization" >&2
+  printf '%s\n' "${before}" >&2
+  exit 1
+fi
+
+git lfs install --local --force >/dev/null
+
+while IFS= read -r -d '' path; do
+  case "${path}" in
+    *.flac|*.gif|*.ico|*.it|*.jpeg|*.jpg|*.mid|*.midi|*.mp3|*.ogg|*.opus|*.otf|*.s3m|*.ttf|*.wav|*.webp|*.woff|*.woff2|*.xm|*.zip|*.png)
+      ;;
+    *)
+      attribute=$(git check-attr filter -- "${path}")
+      expected="${path}: filter: unspecified"
+      if [[ ${attribute} != "${expected}" ]]; then
+        echo "source/config path unexpectedly uses Git LFS: ${attribute}" >&2
+        exit 1
+      fi
+      ;;
+  esac
+done < <(git ls-files -z)
+
+test "$(git check-attr filter -- go.mod)" = 'go.mod: filter: unspecified'
+
+after=$(git status --porcelain=v1 --untracked-files=all)
+if [[ -n ${after} ]]; then
+  echo "Git LFS initialization changed the clean checkout" >&2
+  printf '%s\n' "${after}" >&2
+  exit 1
+fi
diff --git a/tools/package-release.sh b/tools/package-release.sh
index 713270c..3da034e 100755
--- a/tools/package-release.sh
+++ b/tools/package-release.sh
@@ -6,8 +6,13 @@ cd "${repository}"
 
 output=${1:-dist}
 version=${2:-$(git describe --tags --always --dirty)}
-if [[ -n $(git status --porcelain) ]]; then
-  echo "release packaging requires a clean tracked and untracked worktree" >&2
+status=$(git status --porcelain=v1 --untracked-files=all)
+if [[ -n ${status} ]]; then
+  {
+    echo "release packaging requires a clean tracked and untracked worktree"
+    echo "worktree changes:"
+    printf '%s\n' "${status}"
+  } >&2
   exit 1
 fi
 if [[ -e ${output} ]]; then
diff --git a/tools/validate.sh b/tools/validate.sh
index 4b737c8..50b34ee 100755
--- a/tools/validate.sh
+++ b/tools/validate.sh
@@ -21,6 +21,7 @@ go test -run=^$ -bench=. -benchtime=1x ./internal/kernel
 govulncheck ./...
 tools/check-foundations.sh
 tools/check-dependencies.sh
+tools/check-gitattributes.sh
 
 temporary=$(mktemp -d /tmp/atrinik-server-validation.XXXXXX)
 trap 'rm -rf -- "${temporary}"' EXIT