diff --git a/scripts/gdl-sync.py b/scripts/gdl-sync.py
index 0049c80..bee0323 100755
--- a/scripts/gdl-sync.py
+++ b/scripts/gdl-sync.py
@@ -410,7 +410,15 @@ def rsync_command(staging: Path, dest: str, dry_run: bool) -> list[str]:
     `dest` may be a local path or any rsync destination (`user@host:/path`),
     because the archive usually is not writable from the fetch host.
     """
-    cmd = ["rsync", "-a", "--ignore-existing", "--partial", "--info=stats2"]
+    cmd = ["rsync", "-a", "--ignore-existing", "--partial", "--info=stats2",
+           # Belt and braces: the config lives outside staging, but nothing
+           # resembling tooling output should ever reach the archive. Archive
+           # sidecars are always "<date>_<user> - <code>.json", so none of
+           # these can match real content.
+           "--exclude", "gdl-sync*.json",
+           "--exclude", "*.gdl-config.json",
+           "--exclude", ".gdl-*",
+           "--exclude", "*.sqlite", "--exclude", "*.db"]
     if dry_run:
         cmd.append("--dry-run")
     # Trailing slash: copy the *contents* of staging into dest.
@@ -480,7 +488,10 @@ def main() -> int:
 
     config = build_config(args.rate, list(args.sleep_request), list(args.sleep))
     args.staging.mkdir(parents=True, exist_ok=True)
-    config_path = args.staging / "gdl-sync.config.json"
+    # Deliberately a SIBLING of the staging directory, not inside it: staging is
+    # rsynced wholesale into the archive, and a dry run caught this file being
+    # published to the archive root.
+    config_path = args.staging.parent / f"{args.staging.name}.gdl-config.json"
 
     plan: list[tuple[Profile, Source]] = [
         (prof, src)