diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 74ea88e2..c54a7881 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -343,7 +343,7 @@ jobs:
           if printf '%s\n' "$changed_files" | grep -E '^examples/chat/(angular|python)/' >/dev/null; then
             demo_changed=true
           fi
-          if printf '%s\n' "$changed_files" | grep -E '^(vercel\.demo\.json|scripts/(assemble-demo|demo-middleware|langgraph-proxy)\.ts)$' >/dev/null; then
+          if printf '%s\n' "$changed_files" | grep -E '^(vercel\.demo\.json|scripts/(assemble-demo|demo-middleware|langgraph-proxy|rate-limit)\.ts)$' >/dev/null; then
             demo_changed=true
           fi
           if printf '%s\n' "$changed_files" | grep -E '^libs/' >/dev/null; then
diff --git a/scripts/demo-middleware.ts b/scripts/demo-middleware.ts
index 5a25e539..f2c59dfc 100644
--- a/scripts/demo-middleware.ts
+++ b/scripts/demo-middleware.ts
@@ -8,6 +8,11 @@
  * The rate-limit hook is wired here (not in the shared factory) so the
  * cockpit-examples wrapper stays unaffected — its bundle does not pull
  * in @neondatabase/serverless.
+ *
+ * Note: changes to scripts/rate-limit.ts MUST trigger a redeploy of this
+ * function. The ci.yml `Check if demo changed` step watches
+ * scripts/(assemble-demo|demo-middleware|langgraph-proxy|rate-limit)\.ts.
+ * Keep that regex in sync if you split rate-limit into multiple files.
  */
 import { createProxyHandler } from './langgraph-proxy';
 import { checkRateLimit } from './rate-limit';