diff --git a/src/main/wsl/__fixtures__/wsl-invocation-allowlist.txt b/src/main/wsl/__fixtures__/wsl-invocation-allowlist.txt
index c943b8b9ce3..cf300d316c4 100644
--- a/src/main/wsl/__fixtures__/wsl-invocation-allowlist.txt
+++ b/src/main/wsl/__fixtures__/wsl-invocation-allowlist.txt
@@ -21,7 +21,7 @@ main/codex-accounts/service.ts
 main/codex/codex-state-db-backfill-recovery.ts
 main/codex/codex-trust-grant-host.ts
 main/codex/codex-wsl-hook-install-plan.ts
-main/git/runner.ts
+main/git/command-runner/wsl-command-resolution.ts
 main/git/wsl-git-read-environment.ts
 main/ipc/filesystem-watcher-wsl.ts
 main/local-worktree-filesystem.ts
diff --git a/src/main/wsl/wsl-invocation-boundary.test.ts b/src/main/wsl/wsl-invocation-boundary.test.ts
index 6ff1b93404d..dbe708f4821 100644
--- a/src/main/wsl/wsl-invocation-boundary.test.ts
+++ b/src/main/wsl/wsl-invocation-boundary.test.ts
@@ -345,7 +345,7 @@ describe('wsl.exe is spawned through one runner', () => {
     // ALLOWLIST.length >= N` cannot fail while the allowlist alone exceeds N,
     // so it passed even for a scanner that found nothing. This fails the moment
     // detection stops seeing a call that is definitely there.
-    expect(offenders).toContain('main/git/runner.ts')
+    expect(offenders).toContain('main/git/command-runner/wsl-command-resolution.ts')
   })
 
   it('adds no new direct wsl.exe spawn', () => {
diff --git a/src/shared/child-process/__fixtures__/child-process-import-allowlist.txt b/src/shared/child-process/__fixtures__/child-process-import-allowlist.txt
index 028db0706e8..5b5a14e54a1 100644
--- a/src/shared/child-process/__fixtures__/child-process-import-allowlist.txt
+++ b/src/shared/child-process/__fixtures__/child-process-import-allowlist.txt
@@ -8,6 +8,10 @@
 #
 # Migrating a file means replacing its spawn/execFile calls with
 # runProcess/spawnProcess and deleting its line here.
+#
+# The src/main/git/command-runner/* entries are the seven spawn sites that used
+# to live in the single line src/main/git/runner.ts; splitting that file moved
+# them, it did not add any.
 src/cli/handlers/account.ts
 src/cli/handlers/core.ts
 src/cli/handlers/interactive-login-interruption.ts
@@ -57,7 +61,13 @@ src/main/emulator/serve-sim-runtime-materializer.ts
 src/main/emulator/simctl-simulator-devices.ts
 src/main/emulator/simulator-app-visibility.ts
 src/main/external-editor-launch.ts
-src/main/git/runner.ts
+src/main/git/command-runner/exec-file-capture.ts
+src/main/git/command-runner/git-exec-file.ts
+src/main/git/command-runner/git-spawn.ts
+src/main/git/command-runner/git-stream-stdout.ts
+src/main/git/command-runner/spawn-command-capture.ts
+src/main/git/command-runner/spawned-command-tree-kill.ts
+src/main/git/command-runner/wsl-aware-spawn.ts
 src/main/git/wsl-git-read-environment.ts
 src/main/github/gh-utils.ts
 src/main/hooks.ts