diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index f7cad91..7177a68 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -46,6 +46,13 @@ jobs:
           # security-and-quality is broader than the default security-extended;
           # these are small libraries, so the extra findings are affordable.
           queries: security-and-quality
+          # Analyse source only. obj/ and bin/ hold generated and compiled
+          # output — e.g. the xUnit auto-generated entry point — so findings
+          # there are noise against code no human maintains.
+          config: |
+            paths-ignore:
+              - "**/obj/**"
+              - "**/bin/**"
 
       # Explicit build rather than autobuild: these repos multi-target, and
       # autobuild has picked a single TFM in the past, silently analysing half
diff --git a/CHANGELOG.md b/CHANGELOG.md
index dda90d1..597fbdc 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -99,7 +99,9 @@ floor.
 ### Added
 
 - CodeQL code scanning (`security-and-quality` query pack), weekly plus on every
-  push and pull request.
+  push and pull request. Analysis excludes `**/obj/**` and `**/bin/**`, so generated
+  and compiled output — the xUnit auto-generated entry point among it — raises no
+  findings.
 - `SECURITY.md`, `CONTRIBUTING.md`, a pull request template, and a root `CLAUDE.md`.
   `SECURITY.md` states the scope this library does and does not claim — settings are
   stored as plain-text JSON and are explicitly not a place for secrets.