diff --git a/.ansible-lint b/.ansible-lint
index 147ab8c..f4dea75 100644
--- a/.ansible-lint
+++ b/.ansible-lint
@@ -6,6 +6,7 @@ exclude_paths:
   - .venv/
   - .collections/
   - .scaffold/
+  - tests/integration/.run/   # transient harness run dir (gitignored, generated)
   - "**/vault.yml"  # ansible-vault encrypted — not lintable YAML
 
 # Warn only (don't fail) on these rules during initial setup
diff --git a/.yamllint b/.yamllint
index b47f9ca..2a116d7 100644
--- a/.yamllint
+++ b/.yamllint
@@ -24,4 +24,5 @@ ignore: |
   .venv/
   .collections/
   .scaffold/
+  tests/integration/.run/
   **/vault.yml
diff --git a/scripts/integration-vm.py b/scripts/integration-vm.py
index 3cce0d3..417c1e7 100644
--- a/scripts/integration-vm.py
+++ b/scripts/integration-vm.py
@@ -94,6 +94,7 @@ def profile_path(host):
 
 def render_run_hosts(name, ip, ansible_user, groups):
     lines = [
+        "---",
         "# Generated by scripts/integration-vm.py — transient, gitignored. Do not edit.",
         "# Single test host ONLY (safety invariant: no real host is ever in scope).",
         "all:",