diff --git a/src/assembly.xml b/src/assembly.xml
index 60565fa715..afe130bc77 100644
--- a/src/assembly.xml
+++ b/src/assembly.xml
@@ -27,12 +27,38 @@
                 <include>**</include>
             </includes>
             <excludes>
+                <!-- Build output and dependencies -->
                 <exclude>**/target/**</exclude>
+                <exclude>**/node_modules/**</exclude>
+                <exclude>**/.angular/**</exclude>
+                <!-- Release/verification dirs (build.xml candidate.dir &
+                     install.dir), root-anchored. candidate/ holds downloaded
+                     release artifacts incl. a previous *-src.zip; install/ is
+                     a full unpacked binary release (with a generated master
+                     secret) from install-test-home. Never re-bundle either. -->
+                <exclude>candidate/**</exclude>
+                <exclude>install/**</exclude>
+                <!-- IDE / tooling metadata -->
                 <exclude>**/.project</exclude>
                 <exclude>**/.settings/**</exclude>
                 <exclude>**/.idea/**</exclude>
                 <exclude>**/*.iml</exclude>
-                <exclude>**/node_modules/**</exclude>
+                <exclude>**/.scannerwork/**</exclude>
+                <!-- Runtime state generated by running the gateway or tests.
+                     These live outside target/ so `mvn clean` does not remove
+                     them; without these excludes they bloat the source release
+                     (and would ship generated keystores/credentials). -->
+                <exclude>**/data/security/**</exclude>
+                <exclude>**/data/deployments/**</exclude>
+                <exclude>**/data/ldap-server/**</exclude>
+                <exclude>**/logs/*.log</exclude>
+                <exclude>**/logs/*.out</exclude>
+                <exclude>**/logs/*.err</exclude>
+                <exclude>**/*.pid</exclude>
+                <!-- JVM crash / heap dumps -->
+                <exclude>**/*.hprof</exclude>
+                <exclude>**/hs_err_pid*.log</exclude>
+                <exclude>**/replay_pid*.log</exclude>
             </excludes>
         </fileSet>
     </fileSets>