diff --git a/.forgejo/workflows/site.yml b/.forgejo/workflows/site.yml
index 9cd96f0..28c3cd1 100644
--- a/.forgejo/workflows/site.yml
+++ b/.forgejo/workflows/site.yml
@@ -14,12 +14,15 @@
 
 name: site
 
+# BLOCKED (2026-07-16): the runner (aaron) cannot open an SSH data connection to
+# groucho. aaron's direct iface to groucho's subnet (ens18, 10.20.20.x) is down,
+# so aaron routes to groucho via ada (10.0.0.2) and the groucho->aaron data path
+# drops packets (TCP connects + ICMP ok, but the SSH banner never returns; proven:
+# aaron->ada:22 gets a banner, aaron->groucho:22 does not). Not MTU/fail2ban/DNS.
+# Until aaron<->groucho networking is fixed, deploy the site from a machine that
+# reaches groucho via ada:  `ansible-playbook -i comunes_inventory.ini tane-landing.yml`
+# (see site/DEPLOY.md). Trigger left manual-only so it stops failing on every push.
 on:
-  push:
-    branches: [main]
-    paths:
-      - 'site/**'
-      - 'docs/**'
   workflow_dispatch:
 
 concurrency: