diff --git a/local/scripts/gate-kx11extras.py b/local/scripts/gate-kx11extras.py
index 99be5e25ed..adf609fddb 100755
--- a/local/scripts/gate-kx11extras.py
+++ b/local/scripts/gate-kx11extras.py
@@ -370,7 +370,12 @@ def gate_raw_x11_includes(text: str) -> tuple[str, int]:
     r"""Guard bare `#include <X11/...>` / `<xcb/...>` that sit outside HAVE_X11.
 
     Distinct from the KWindowSystem-API gating above: these are the Xlib/XCB
-    headers themselves. A Wayland-only sysroot ships none of them, so each is a
+    headers themselves, plus the X11-only KDE headers that KWindowSystem ships
+    only with its X11 component -- fixx11h.h (X11 macro cleanup), netwm.h and
+    netwm_def.h (EWMH). Those carry no X11/ or xcb/ path prefix, so a
+    prefix-only rule missed them:
+      logout-greeter/shutdowndlg.cpp:51: fatal error: fixx11h.h: No such file
+ A Wayland-only sysroot ships none of them, so each is a
     hard compile failure:
       appmenu/appmenu.h:13: fatal error: xcb/xcb.h: No such file or directory
 
@@ -406,7 +411,9 @@ def gate_raw_x11_includes(text: str) -> tuple[str, int]:
                 inx -= 1
             out.append(line)
             continue
-        if inx == 0 and re.match(r"#\s*include\s*<(X11/|xcb/)", st):
+        if inx == 0 and re.match(
+            r"#\s*include\s*<(X11/|xcb/|fixx11h\.h|netwm\.h|netwm_def\.h)", st
+        ):
             ind = re.match(r"[ \t]*", line).group(0)
             out.append(f"{ind}{GUARD_OPEN}")
             out.append(line)