diff --git a/SLASHED-for-WP/includes/class-manual-css-page.php b/SLASHED-for-WP/includes/class-manual-css-page.php
index 648d8eb1..e58d5366 100644
--- a/SLASHED-for-WP/includes/class-manual-css-page.php
+++ b/SLASHED-for-WP/includes/class-manual-css-page.php
@@ -61,10 +61,11 @@ public function handle_save() {
 		if ( 'clear' === $action ) {
 			update_option( self::OPTION_KEY, '' );
 		} else {
-			// phpcs:ignore WordPress.Security.ValidatedSanitizedInput.InputNotSanitized -- CSS cannot be sanitized via wp_kses without corrupting valid rules (e.g. `>`, `[attr~="val"]`). The value is validated below and stored raw; output is escaped at render time.
+			// phpcs:disable WordPress.Security.ValidatedSanitizedInput.InputNotSanitized -- CSS cannot be sanitized via wp_kses without corrupting valid rules (e.g. `>`, `[attr~="val"]`). The value is validated below against injection patterns and stored raw; output is escaped at render time.
 			$raw_css = isset( $_POST['slashed_manual_css'] )
 				? wp_unslash( $_POST['slashed_manual_css'] )
 				: '';
+			// phpcs:enable WordPress.Security.ValidatedSanitizedInput.InputNotSanitized
 			// CSS must not be able to break out of an inline <style> context.
 			// Only block </style and <script; do NOT use wp_strip_all_tags() because
 			// it removes everything between < and >, corrupting valid CSS like
diff --git a/scripts/zip-plugin.js b/scripts/zip-plugin.js
index f1b57468..c1ffaa64 100644
--- a/scripts/zip-plugin.js
+++ b/scripts/zip-plugin.js
@@ -39,6 +39,8 @@ const PLUGIN_ROOT = 'SLASHED-for-WP';
 // src is the repo path; dest is the path inside the slashed/ zip folder.
 const INCLUDE = [
   { src: `${PLUGIN_ROOT}/slashed.php`,                                  dest: 'slashed.php' },
+  { src: `${PLUGIN_ROOT}/readme.txt`,                                   dest: 'readme.txt',  required: true },
+  { src: `${PLUGIN_ROOT}/license.txt`,                                  dest: 'license.txt', required: true },
   { src: `${PLUGIN_ROOT}/includes`,                                     dest: 'includes' },
   { src: `${PLUGIN_ROOT}/assets/admin-app`,                             dest: 'assets/admin-app', required: true },
   { src: `${PLUGIN_ROOT}/dist`,                                         dest: 'dist', required: true },