diff --git a/deploy.sh b/deploy.sh
index 27cf72d..e74f241 100755
--- a/deploy.sh
+++ b/deploy.sh
@@ -219,6 +219,26 @@ ssh "$REMOTE_HOST" "mkdir -p '$REMOTE_DIR'"
 # build*/ covers every local build tree, not just build/. They are machine-specific
 # and the device regenerates its own build/ remotely, so shipping build-tui/ etc.
 # just pushed tens of MB of x86 object files the device can never use.
+#
+# Only what git knows about is copied: the tracked files and new ones not yet
+# added, as they are in the working tree, so uncommitted work still deploys.
+# Whatever .gitignore names stays behind - build trees, the editor's cache,
+# Claude Code worktrees, the 12-bit report's full-size example pictures - which
+# made a deploy 505 MB, where 7 MB was needed, while the whole folder was
+# mirrored. The set is staged locally so the rsync below keeps its --delete: a
+# file git no longer has, or clutter an older deploy left, is removed from the
+# tower, and the excludes still protect the tower's own files as before.
+git rev-parse --git-dir >/dev/null 2>&1 || {
+    echo "error: deploy from a git checkout - it decides what is copied" >&2
+    exit 1
+}
+STAGE="$(mktemp -d)"
+trap 'rm -rf "$STAGE"' EXIT
+chmod 0755 "$STAGE"     # rsync gives the tower's project folder these permissions
+# --ignore-missing-args: a tracked file deleted but not yet committed is listed
+git ls-files -z --cached --others --exclude-standard |
+    rsync -a --from0 --files-from=- --ignore-missing-args ./ "$STAGE/"
+
 echo ">> syncing to $REMOTE_HOST:$REMOTE_DIR"
 rsync -avz --delete \
     --exclude 'build*/' \
@@ -235,7 +255,7 @@ rsync -avz --delete \
     --exclude 'config/camera_profiles/**/*.xml' \
     --exclude 'config/camera_profiles/**/*.txt' \
     --exclude 'images/' \
-    ./ "$REMOTE_HOST:$REMOTE_DIR/"
+    "$STAGE/" "$REMOTE_HOST:$REMOTE_DIR/"
 
 # .git is not synced, so leave the revision beside the tree for the tools that
 # run THERE and need to know what they are building (install-tower, flash.sh).
diff --git a/docs/deployment.md b/docs/deployment.md
index 3e0bba5..b36c7e1 100644
--- a/docs/deployment.md
+++ b/docs/deployment.md
@@ -76,7 +76,11 @@ and which mode it starts in are the tower's own `config.ini` `[Startup] home` /
 ```
 
 It syncs the tree (leaving `.git` behind, and writing the revision into
-`.revision` beside it instead), then configures and builds **on the tower**. The
+`.revision` beside it instead), then configures and builds **on the tower**. Only
+files git knows about are synced - tracked ones and new ones not yet added, as
+they are in the working tree - so nothing `.gitignore` names (build trees, editor
+caches, `.claude/worktrees/`, the camera bench's example pictures) reaches the
+tower, and a file left there by an older deploy is removed. The
 program already running keeps running the old binary until it is restarted:
 
 ```bash