diff --git a/.github/workflows/apache-rat-audit.yml b/.github/workflows/apache-rat-audit.yml
index 53df0a40b40..6cecf9dbabb 100644
--- a/.github/workflows/apache-rat-audit.yml
+++ b/.github/workflows/apache-rat-audit.yml
@@ -115,7 +115,7 @@ jobs:
       - name: Check for binary files
         run: |
           echo "Checking for binary files..."
-          echo "Checking extensions: class, jar, tar, tgz, zip, exe, dll, so, gz, bz2"
+          echo "Checking extensions: class, jar, tar, tgz, zip, exe, dll, so, gz, bz2, deb, rpm, gppkg, bin"
           echo "----------------------------------------------------------------------"
           
           # Binary file allowlist, see README.apache.md
@@ -127,10 +127,12 @@ jobs:
             "src/bin/gpfdist/regress/data/gpfdist2/gz_multi_chunk_2.tbl.gz"
             "src/bin/gpfdist/regress/data/gpfdist2/lineitem.tbl.bz2"
             "src/bin/gpfdist/regress/data/gpfdist2/lineitem.tbl.gz"
+            "gpMgmt/test/behave/mgmt_utils/steps/data/sample.gppkg"
+            "src/bin/pgevent/MSG00001.bin"
           )
           
           # Check for specific binary file extensions
-          binary_extensions="class jar tar tgz zip exe dll so gz bz2"
+          binary_extensions="class jar tar tgz zip exe dll so gz bz2 deb rpm gppkg bin"
           echo "BINARY_EXTENSIONS=${binary_extensions}" >> $GITHUB_ENV
           binary_results=""
           binaryfiles_found=false
diff --git a/README.apache.md b/README.apache.md
index e99f2b2328f..adeedace124 100644
--- a/README.apache.md
+++ b/README.apache.md
@@ -50,3 +50,31 @@ The following compressed files are included in the source tree. These files are
 - src/bin/gpfdist/regress/data/gpfdist2/gz_multi_chunk_2.tbl.gz
 - src/bin/gpfdist/regress/data/gpfdist2/lineitem.tbl.bz2
 - src/bin/gpfdist/regress/data/gpfdist2/lineitem.tbl.gz
+
+## Binary Files in Source
+
+A source release should not carry compiled artifacts, so the licence audit
+workflow fails on binary file extensions unless the file is allowlisted. The
+following are allowed, with the reason for each.
+
+- gpMgmt/test/behave/mgmt_utils/steps/data/sample.gppkg
+
+  A small sample package that the `gppkg` behave suite installs and removes.
+  The tests exercise package handling itself, so the fixture has to be a real
+  package.
+
+- src/bin/pgevent/MSG00001.bin
+
+  Inherited from PostgreSQL, where it is also shipped. It is the output of the
+  Microsoft Message Compiler and is referenced from `pgmsgevent.rc` when
+  building the Windows event log DLL; `src/bin/pgevent/README` describes how it
+  is produced. Cloudberry does not build it: `src/bin/Makefile` only puts
+  `pgevent` in `SUBDIRS` when `PORTNAME` is `win32`.
+
+The PAX Python API test data under
+`contrib/pax_storage/src/api/python3/test/` (`test.file1` through `test.file9`,
+plus `test.file3.vm1`, `test.file3.vm2` and `test.file7.toast`) is also binary:
+each file is a PAX-format data file covering a particular set of column types,
+read by `paxpy_test.py`. These names carry no recognised extension, so the
+workflow's extension-based check does not see them; they are recorded here so
+the set is documented rather than invisible.
diff --git a/gpMgmt/demo/gppkg/data/sample-0.0-1.amd64.deb b/gpMgmt/demo/gppkg/data/sample-0.0-1.amd64.deb
deleted file mode 100644
index 729515c6593..00000000000
Binary files a/gpMgmt/demo/gppkg/data/sample-0.0-1.amd64.deb and /dev/null differ
diff --git a/gpMgmt/demo/gppkg/data/sample-0.0.1-noop.x86_64.rpm b/gpMgmt/demo/gppkg/data/sample-0.0.1-noop.x86_64.rpm
deleted file mode 100644
index ab635f140a3..00000000000
Binary files a/gpMgmt/demo/gppkg/data/sample-0.0.1-noop.x86_64.rpm and /dev/null differ