diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml
index 38dfc419..56169b29 100644
--- a/.github/workflows/deploy.yml
+++ b/.github/workflows/deploy.yml
@@ -83,6 +83,9 @@ jobs:
           python3 scripts/csp_audit.py output
 
       - name: Check links in built site
+        # URL exclusions live in .lycheeignore (single source of truth, shared
+        # with the weekly link-rot workflow; lychee reads it automatically).
+        # Path exclusions stay inline: .lycheeignore holds URL patterns only.
         uses: lycheeverse/lychee-action@e7477775783ea5526144ba13e8db5eec57747ce8 # v2.9.0
         with:
           args: >-
@@ -93,10 +96,6 @@ jobs:
             --accept 200..=299,429
             --max-retries 5
             --retry-wait-time 2
-            --exclude "web\.archive\.org"
-            --exclude "linkedin\.com"
-            --exclude "hrw\.org"
-            --exclude "rivassec\.com/tools/iam-blast-radius"
             --exclude-path output/feeds
             --exclude-path output/tools
             './output/**/*.html'
diff --git a/.lycheeignore b/.lycheeignore
index 4aee3c2a..371a3530 100644
--- a/.lycheeignore
+++ b/.lycheeignore
@@ -7,7 +7,14 @@
 ^https?://host(:|$|/)
 ^https?://127\.0\.0\.1
 # Hosts that block automated checkers while working fine in browsers
-# (LinkedIn returns 999 to bots; X/Twitter gates aggressively).
+# (LinkedIn returns 999 to bots; X/Twitter gates aggressively; hrw.org and
+# web.archive.org rate-limit or gate scripted fetches).
 ^https?://(www\.)?linkedin\.com
 ^https?://(www\.)?x\.com
 ^https?://(www\.)?twitter\.com
+web\.archive\.org
+hrw\.org
+# The IAM Blast Radius tool page is a vendored SPA shipped as static files;
+# its internal anchors are not crawlable HTML (deploy also --exclude-path's
+# output/tools for the same reason).
+rivassec\.com/tools/iam-blast-radius