diff --git a/.github/scripts/pr-malware-scan.cjs b/.github/scripts/pr-malware-scan.cjs
index c94892b7..d23ede33 100644
--- a/.github/scripts/pr-malware-scan.cjs
+++ b/.github/scripts/pr-malware-scan.cjs
@@ -32,7 +32,7 @@ const POPULAR_PACKAGES = [
   'workbox-core', 'vite-plugin-pwa', 'msw', 'supertest', 'zxcvbn', 'otplib', 'speakeasy', 'nodemailer',
 ];
 
-const TEXT_EXT = /\.(c|m)?(j|t)sx?$|\.(json|jsonc|md|mdx|rs|toml|ya?ml|css|scss|html|sql|prisma|lock|svg|txt|snap|sh|py|graphql|spec|example|env|xml|csv|ini|cfg|conf|dict|gitignore|gitattributes|editorconfig|nvmrc|npmrc|dockerignore|mts|cts|vue|svelte|astro|less|sass|go|mod|sum)$/i;
+const TEXT_EXT = /\.(c|m)?(j|t)sx?$|\.(json|jsonc|md|mdx|rs|toml|ya?ml|css|scss|html|sql|prisma|lock|svg|txt|snap|sh|py|graphql|spec|example|env|xml|csv|ini|cfg|conf|dict|gitignore|gitattributes|editorconfig|nvmrc|npmrc|dockerignore|mts|cts|vue|svelte|astro|less|sass|go|mod|sum|tla)$/i;
 const MEDIA_EXT = /\.(woff2?|ttf|otf|eot|png|jpe?g|gif|ico|webp|bmp|pdf|mp3|mp4|wav|zip|gz|tgz|wasm)$/i;
 const DOC_EXT = /\.(md|mdx|txt)$/i;
 const GENERATED = /(^|\/)(package-lock\.json|Cargo\.lock|yarn\.lock|pnpm-lock\.yaml)$|(^|\/)test_snapshots\/|(^|\/)generated\/|\.snap$|\.min\.(js|css)$|\.svg$/;
diff --git a/changelog.d/scanner-tla-extension.md b/changelog.d/scanner-tla-extension.md
new file mode 100644
index 00000000..1ebf8fd0
--- /dev/null
+++ b/changelog.d/scanner-tla-extension.md
@@ -0,0 +1,4 @@
+Malware scan: TLA+ specifications (`.tla`) are now scanned as text, like
+other source files. Before this, a TLA+ spec was flagged HIGH as "disguised
+code", which wrongly blocked docforum-escrow #225. Every line rule still
+applies to `.tla` files.