diff --git a/tools/export-github.sh b/tools/export-github.sh
index c884630..dc96033 100755
--- a/tools/export-github.sh
+++ b/tools/export-github.sh
@@ -30,6 +30,13 @@ done
 [ -d "$PUB/.git" ] || { echo "publication repo missing at $PUB"; exit 1; }
 
 # --- 1. sync the tree (working -> pub), minus everything never published ---
+#
+# NOTE the deploy/windows/installer/bundle exclude below. That is ~100MB of build
+# output holding a COPY of the whole application tree plus the wheels and vendor
+# installers. It is gitignored, but this sync walks the WORKING TREE rather than
+# git, so it came through anyway - and its copies of config.py and
+# requirements.txt then tripped the scrub gate. Anything else generated into the
+# working tree needs excluding here too, for the same reason.
 rsync -a --delete \
   --exclude '.git' \
   --exclude '.gitea' \
@@ -45,6 +52,10 @@ rsync -a --delete \
   --exclude 'tests/test_plugins/test_zabbix_live.py' \
   --exclude 'venv' \
   --exclude 'node_modules' \
+  --exclude 'deploy/windows/installer/bundle' \
+  --exclude 'deploy/windows/installer/Output' \
+  --exclude 'deploy/windows/installer/plugins.iss' \
+  --exclude 'deploy/windows/installer/version.iss' \
   --exclude 'frontend/dist*' \
   --exclude 'frontend/src/.plugins-staged' \
   --exclude 'frontend/src/router/routes.gen.js' \