diff --git a/access-matrix.sh b/access-matrix.sh
index 47c9c1c..057423c 100644
--- a/access-matrix.sh
+++ b/access-matrix.sh
@@ -6,7 +6,7 @@ set -u
 cd /home/reachableceo/projects/PFVCluster || exit 1
 
 # Policy-excluded systems (never attempt access)
-EXCLUDE=':tsys-cloudron:pfv-bms:tsys-umbrel:stlpc-bizoffice:ultix-highside:'
+EXCLUDE=':tsys-cloudron:pfv-bms:tsys-umbrel:tsys-ucs-01:tsys-ucs-02:stlpc-bizoffice:ultix-highside:'
 
 # Determine the SSH user(s) for a given hostname and whether sudo is expected.
 # Returns "user1:user2:...:sudoflag" where sudoflag is "yes" or "no".
diff --git a/bootstrap-all.sh b/bootstrap-all.sh
index 1b2fadb..b474493 100644
--- a/bootstrap-all.sh
+++ b/bootstrap-all.sh
@@ -62,10 +62,12 @@ run_with_su ultix-field 100.115.233.124 ultixfield ultixfield
 echo "========================================"
 echo "Done. Tell the agent to re-run access-matrix.sh to verify."
 echo "========================================"
-echo "Blocked — need console work (separate tickets):"
-echo "  tsys-ucs-01, tsys-ucs-02 — remove 2FA first [#418]"
+echo "Blocked — need console work (separate ticket):"
 echo "  stlpc-3dscanner — bring online + rename [#417]"
 echo "========================================"
+echo "Excluded (managed via API, not SSH):"
+echo "  tsys-ucs-01, tsys-ucs-02"
+echo "========================================"
 echo "2FA by design (leave alone):"
 echo "  sectestbed-sandbox"
 echo "========================================"