diff --git a/.openapi-generator-ignore b/.openapi-generator-ignore
index 7da38a1..67dea58 100644
--- a/.openapi-generator-ignore
+++ b/.openapi-generator-ignore
@@ -31,3 +31,12 @@ scripts/**
 # Protect custom tests and examples
 tests/**
 examples/**
+
+# Protect our own CI workflows + CODEOWNERS. The Python openapi-generator
+# template writes a default .github/workflows/python.yml on every regen,
+# and post_generate.py used to `shutil.rmtree('.github')` to clean it up —
+# which collateral-deleted our entire .github/ tree (generate.yml,
+# publish-pypi.yml, publish-testpypi.yml, sdk-update.yml, CODEOWNERS).
+# Adding the directory here means the generator never writes there in the
+# first place, so there's nothing for the cleanup step to nuke.
+.github/**
diff --git a/scripts/post_generate.py b/scripts/post_generate.py
index 0f39f7f..2af949d 100755
--- a/scripts/post_generate.py
+++ b/scripts/post_generate.py
@@ -31,9 +31,16 @@ def cleanup_generator_artifacts() -> None:
     """Remove unwanted files the generator may leave at the project root."""
     print("Cleaning up generator artifacts...")
 
+    # NOTE: do NOT add ".github" to this list. The Python openapi-generator
+    # template used to write a default .github/workflows/python.yml, and an
+    # earlier version of this script `shutil.rmtree`'d the whole .github/
+    # dir to clean that up — which collateral-deleted our own workflows
+    # (generate.yml, publish-pypi.yml, publish-testpypi.yml, sdk-update.yml)
+    # and CODEOWNERS on every regen. We now block the generator from writing
+    # to .github/ via .openapi-generator-ignore instead, so there's nothing
+    # to clean up here.
     for unwanted in [
         ".gitlab-ci.yml",
-        ".github",
         "test-requirements.txt",
     ]:
         path = PROJECT_ROOT / unwanted