diff --git a/scripts/check-no-app-ffi.sh b/scripts/check-no-app-ffi.sh
index 721176fa..6533043d 100755
--- a/scripts/check-no-app-ffi.sh
+++ b/scripts/check-no-app-ffi.sh
@@ -22,16 +22,23 @@ for relative_path in "${forbidden_paths[@]}"; do
   fi
 done
 
-if rg -n \
-  "copy_ffi_framework|generate_ffi_bindings|integrate_rust_flutter|flutter_rust_bridge|libcodex_ffi|codex_ffi_generated|ffi-(copy|generate|integrate)|build-macos-ffi" \
+forbidden_ffi_pattern='copy_ffi_framework|generate_ffi_bindings|integrate_rust_flutter|flutter_rust_bridge|libcodex_ffi|codex_ffi_generated|ffi-(copy|generate|integrate)|build-macos-ffi'
+
+matches="$(grep -RInE \
+  --binary-files=without-match \
+  --exclude='check-no-app-ffi.sh' \
+  --exclude-dir='Pods' \
+  --exclude-dir='ephemeral' \
+  --exclude-dir='build' \
+  --exclude-dir='.dart_tool' \
+  "$forbidden_ffi_pattern" \
   "$ROOT_DIR/Makefile" \
   "$ROOT_DIR/scripts" \
   "$ROOT_DIR/lib" \
-  "$ROOT_DIR/macos/Runner.xcodeproj" \
-  --glob '!scripts/check-no-app-ffi.sh' \
-  --glob '!**/Pods/**' \
-  --glob '!**/Flutter/ephemeral/**' \
-  --glob '!**/build/**'; then
+  "$ROOT_DIR/macos/Runner.xcodeproj" || true)"
+
+if [[ -n "$matches" ]]; then
+  echo "$matches" >&2
   echo "Forbidden app-side FFI integration reference found." >&2
   failures=$((failures + 1))
 fi