diff --git a/.gitea/workflows/deploy-to-s3.yml b/.gitea/workflows/deploy-to-s3.yml
index b4102e0..c5883f0 100644
--- a/.gitea/workflows/deploy-to-s3.yml
+++ b/.gitea/workflows/deploy-to-s3.yml
@@ -47,12 +47,18 @@ jobs:
       - name: Checkout repository
         uses: actions/checkout@v3
 
-      # NOTE: this zip still contains frontend/node_modules, roughly 90 MB and
-      # the bulk of the artifact. It is left in deliberately. Nothing in this
-      # repo says what unpacks the zip on the other side — there is no appspec
-      # file and no deploy script here — so if that side runs the app without
-      # installing dependencies, dropping node_modules would break the deploy.
-      # Confirm what consumes the bucket object, then add -x "frontend/node_modules/*".
+      # frontend/node_modules is excluded, and that is safe because of what
+      # happens to this object downstream. CodeDeploy pulls it, extracts to
+      # /opt/codedeploy-extracted-5, copies the tree to
+      # /home/ec2-user/utopia-ai-hr-ats-portal-deployment-group and runs
+      # `docker compose --env-file ./backend/.env up -d --build`. The only Node
+      # service is the frontend, whose image does `npm ci` from the lockfile,
+      # and frontend/.dockerignore excludes node_modules/ from the build context
+      # outright. So the committed tree was carried into every artifact and then
+      # thrown away unread. It was 90 MB of a 33 MB compressed upload.
+      #
+      # node_modules is still tracked in git, which is the reason it was here at
+      # all. Untracking it is a separate change and affects other branches.
       - name: Archive project
         run: |
           apt-get update -y
@@ -61,6 +67,7 @@ jobs:
             -x ".git/*" \
             -x ".gitea/*" \
             -x ".gitignore" \
+            -x "frontend/node_modules/*" \
             -x "*.DS_Store"
 
       - name: Install AWS CLI