diff --git a/tools/export-github.sh b/tools/export-github.sh
index 2d13a5a0..029c2d09 100755
--- a/tools/export-github.sh
+++ b/tools/export-github.sh
@@ -123,6 +123,12 @@ done
 
 # NOTE ON EXCLUDES: this walks the WORKING TREE, so .gitignore does not apply.
 # Anything ignored-but-present has to be named here or it reaches publication -
+# The agent's .NET build output (agent/*/obj, agent/*/bin) is gitignored but
+# rsync walks the WORKING TREE, so a local `dotnet build` puts absolute host
+# paths into project.assets.json and friends and the scrub gate stops the whole
+# export. Excluded here rather than left to whoever built the agent last to
+# remember to clean up. Same shape as the .env.bak below.
+#
 # how a stray .env.bak once did, and how devnotes/ (local review writeups, chat
 # handoffs) did. The scrub gate catches such things, which is the point, but a
 # gate failure is a stop, not a filter: add the exclude rather than deleting
@@ -145,6 +151,8 @@ rsync -a --delete \
   --exclude 'tests/test_plugins/test_zabbix_live.py' \
   --exclude 'venv' \
   --exclude 'node_modules' \
+  --exclude 'agent/*/obj' \
+  --exclude 'agent/*/bin' \
   --exclude 'deploy/windows/installer/bundle' \
   --exclude 'deploy/windows/installer/Output' \
   --exclude 'deploy/windows/installer/plugins.iss' \