diff --git a/.gitignore b/.gitignore
index 2b2cdd2..de2b79d 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1,4 +1,3 @@
-# vim swap files
 **/*.sw[po]
 
 # don't commit terraform state or lock. the repo code is the only state we care about.
@@ -6,13 +5,10 @@
 **/.terraform.lock.hcl
 **/.terraform
 
-# IDE Folders
 **/.vscode
 
-# Mac Finder cache
 **/.DS_Store
 
-# Plan output
 plan-output.txt
 
 # Generated pre-commit configuration
diff --git a/aws-s3.tf b/aws-s3.tf
index 2680bd6..7660cbe 100644
--- a/aws-s3.tf
+++ b/aws-s3.tf
@@ -66,7 +66,8 @@ resource "aws_s3_bucket" "web" {
   }
 }
 
-# Make "web" buckets publicly accessible
+# S3 website endpoints cannot authenticate object requests. This access block
+# permits public controls; the following policy grants anonymous GetObject.
 resource "aws_s3_bucket_public_access_block" "web" {
   for_each                = aws_s3_bucket.web
   bucket                  = each.value.bucket
diff --git a/opencode.json b/opencode.json
index 28c4af5..6ce2119 100644
--- a/opencode.json
+++ b/opencode.json
@@ -16,6 +16,7 @@
     "aws-prod": {"enabled": false},
     "grafana": {"enabled": false},
     "terraform-docs": {"enabled": false},
+    "argocd-makeitwork": {"enabled": true},
     "argocd-staging-eks": {"enabled": false},
     "argocd-prod-eks": {"enabled": false}
   },
@@ -29,6 +30,7 @@
     "aws-prod_*": false,
     "grafana_*": false,
     "terraform-docs_*": false,
+    "argocd-makeitwork_*": true,
     "argocd-staging-eks_*": false,
     "argocd-prod-eks_*": false
   }