diff --git a/.github/ci-coverage-allowlist.yml b/.github/ci-coverage-allowlist.yml
index 5dffa78776d..b42f943def6 100644
--- a/.github/ci-coverage-allowlist.yml
+++ b/.github/ci-coverage-allowlist.yml
@@ -66,6 +66,12 @@ dockerfiles:
       An example image under cookbook/ that is documentation rather than a shipped artifact
     paths:
       - cookbook/litellm-ollama-docker-image/Dockerfile
+  - reason: >-
+      The FIPS image builds on the pinned cgr.dev/berri.ai chainguard-base-fips base and every apk
+      call authenticates to virtualapk.cgr.dev with a Chainguard token supplied as a build secret;
+      no pull request job holds that token, so no job can build it
+    paths:
+      - docker/Dockerfile.fips
   - reason: >-
       The Rust gateway image compiles the whole workspace in release mode, which is too slow for
       a per-pull-request job while the gateway binary is still being assembled; the Rust lint,