diff --git a/docs/tools.go b/docs/tools.go
new file mode 100644
index 0000000..3daea20
--- /dev/null
+++ b/docs/tools.go
@@ -0,0 +1,14 @@
+//go:build tools
+
+package docs
+
+// generate.go carries `//go:build ignore`, so `go mod tidy` cannot see its
+// import of cobra/doc and prunes go-md2man and blackfriday from go.sum. Doc
+// generation then fails with a missing go.sum entry, which is what broke the
+// docs check on every dependabot module bump.
+//
+// This blank import is what stops that. `go mod tidy` evaluates imports under
+// all build tag combinations, unlike the compiler, so the `tools` tag keeps the
+// file out of every real build while still holding those hashes pinned.
+
+import _ "github.com/spf13/cobra/doc"
diff --git a/go.mod b/go.mod
index 91fb393..5273575 100644
--- a/go.mod
+++ b/go.mod
@@ -11,6 +11,7 @@ require (
 	github.com/modelcontextprotocol/go-sdk v1.4.0
 	github.com/spf13/cobra v1.10.0
 	github.com/stretchr/testify v1.11.1
+	golang.org/x/crypto v0.46.0
 	golang.org/x/term v0.41.0
 	gopkg.in/yaml.v3 v3.0.1
 )
@@ -47,7 +48,6 @@ require (
 	github.com/ulikunitz/xz v0.5.15 // indirect
 	github.com/yosida95/uritemplate/v3 v3.0.2 // indirect
 	gitlab.com/gitlab-org/api/client-go v1.9.1 // indirect
-	golang.org/x/crypto v0.46.0 // indirect
 	golang.org/x/oauth2 v0.34.0 // indirect
 	golang.org/x/sys v0.42.0 // indirect
 	golang.org/x/text v0.32.0 // indirect