diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 1d80849..d4052e9 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -22,6 +22,12 @@ jobs:
     env:
       RAILS_VERSION: ${{ matrix.rails }}
       ACTIVE_ADMIN_VERSION: ${{ matrix.activeadmin }}
+      # Chrome occasionally fails to hand back a websocket URL within the
+      # 15s default and the leg dies with Ferrum::ProcessTimeoutError.
+      # See the note in spec/rails_helper.rb: it happens mid-suite, on a
+      # browser restart rather than a cold start, so a wider budget is
+      # the honest mitigation while the cause is unknown.
+      CAPYBARA_PROCESS_TIMEOUT: 60
     steps:
       - uses: actions/checkout@v4
       - uses: ruby/setup-ruby@v1
diff --git a/capybara_active_admin.gemspec b/capybara_active_admin.gemspec
index 90bb4b8..2bf7af6 100644
--- a/capybara_active_admin.gemspec
+++ b/capybara_active_admin.gemspec
@@ -18,10 +18,14 @@ Gem::Specification.new do |spec|
   spec.metadata['source_code_uri'] = spec.homepage
   spec.metadata['changelog_uri'] = "#{spec.homepage}/blob/master/CHANGELOG.md"
 
-  # Specify which files should be added to the gem when it is released.
-  # The `git ls-files -z` loads the files in the RubyGem that have been added into git.
+  # Whitelist, not a reject list: a new directory in the repo does not
+  # reach consumers until it is named here. The reject form needs a new
+  # pattern every time the repo grows one, and that is how the VuePress site under docs/
+  # ended up published in the first place.
+  # `exe/` matches the bindir below; `bin/` is setup/console dev scripts
+  # and stays out.
   spec.files = Dir.chdir(File.expand_path(__dir__)) do
-    `git ls-files -z`.split("\x0").reject { |f| f.match(%r{^(test|spec|features)/}) }
+    `git ls-files -z -- lib exe README.md LICENSE.txt CHANGELOG.md`.split("\x0")
   end
   spec.bindir        = 'exe'
   spec.executables   = spec.files.grep(%r{^exe/}) { |f| File.basename(f) }
diff --git a/spec/rails_helper.rb b/spec/rails_helper.rb
index 4b3da49..b23ecaf 100644
--- a/spec/rails_helper.rb
+++ b/spec/rails_helper.rb
@@ -26,6 +26,26 @@
 end
 
 # Capybara JS driver
+#
+# CI occasionally dies with
+#
+#   Ferrum::ProcessTimeoutError: Browser did not produce websocket url
+#   within 15 seconds
+#
+# The cause is not established, and it does not reproduce locally (15
+# consecutive full-suite runs, clean). What the CI logs do show is that
+# it is not a cold-start problem: the failing `visit` is never the first
+# one in the run, and in the last occurrence the app was still serving
+# requests from a live browser three seconds into the window that timed
+# out. That points at a restart racing a browser that has not finished
+# dying, not at Chrome being unable to start.
+#
+# So CI sets CAPYBARA_PROCESS_TIMEOUT=60 (see .github/workflows/ci.yml)
+# and a rerun is the answer when it still happens. Two explanations were
+# tried and disproved in the sibling repos: /dev/shm exhaustion (Ferrum
+# already passes --disable-dev-shm-usage by default) and the
+# ubuntu-24.04 AppArmor userns restriction (this repo has passed
+# --no-sandbox all along and flakes anyway).
 cuprite_opts = {
     js_errors: true,
     window_size: [1920, 1080],