diff --git a/.gitea/workflows/build-and-publish.yaml b/.gitea/workflows/build-and-publish.yaml
index 3b5bc2b..05db4e5 100644
--- a/.gitea/workflows/build-and-publish.yaml
+++ b/.gitea/workflows/build-and-publish.yaml
@@ -29,8 +29,12 @@ jobs:
 
           echo "Changed packages: $CHANGED"
 
-          # Sync pacman DB so -s can pull current versions (Arch rolling).
-          # -Sy only: full -Syu overwhelms the shared runner host with I/O.
+          # Sync pacman DB so makepkg -s can resolve current deps.
+          # NEVER change this to -Syu. The runner shares I/O with the host
+          # (act_runner runs in network-host mode on the Gitea server). A full
+          # system upgrade here took the host down on 2026-04-20 and required
+          # a hard reboot + Contabo abuse-block recovery. -Sy syncs the DB
+          # only; -s picks targeted makedepends via pacman.
           sudo pacman -Sy --noconfirm
 
           for pkg in $CHANGED; do