diff --git a/.github/readme-source.json b/.github/readme-source.json
index a0f9ba5..83f4e66 100644
--- a/.github/readme-source.json
+++ b/.github/readme-source.json
@@ -1,6 +1,6 @@
 {
   "version": 1,
-  "sha256": "c4b61dc7a9d76fb5320a4ffd9763a01524021bd78f63250cddf71ff269e677a8",
+  "sha256": "009f869403670b9bcb1b30b75850b7a2c3b177b77246b942e054bd8b8f6aa731",
   "history": {
     "forbidden_commits": [
       "5e7eba20575e7194b6cb91a498f3a69d35e1e786"
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index b287bb5..ac2ca94 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -27,7 +27,7 @@ jobs:
       with:
         persist-credentials: false
     - name: Set up development tools
-      uses: nicodes/tools/setup@a1c0321f3b4917a7e99eca42e241e46670f6e1e1
+      uses: nicodes/tools/setup@7b67a800c8b8d690c4483ad9c738da3d1aabbdf6
       env:
         GH_TOKEN: ${{ github.token }}
       timeout-minutes: 5
diff --git a/.github/workflows/dependency-policy.yml b/.github/workflows/dependency-policy.yml
index 231f263..23d2ff2 100644
--- a/.github/workflows/dependency-policy.yml
+++ b/.github/workflows/dependency-policy.yml
@@ -48,7 +48,7 @@ jobs:
       env:
         GH_TOKEN: ${{ github.token }}
       timeout-minutes: 7
-      uses: nicodes/tools/dependencies@a1c0321f3b4917a7e99eca42e241e46670f6e1e1
+      uses: nicodes/tools/dependencies@7b67a800c8b8d690c4483ad9c738da3d1aabbdf6
       with:
         apply: 'true'
         output: ${{ runner.temp }}/dependency-report.json
diff --git a/README.md b/README.md
index fee1537..5749bfd 100644
--- a/README.md
+++ b/README.md
@@ -1,4 +1,4 @@
-<!-- Generated from private documentation source. Do not edit directly. Source SHA256: f8f3c13b727c31a7fadbd2ed1e80ef5d1fbaafda852acd3be0e3060c156f9131 -->
+<!-- Generated from private documentation source. Do not edit directly. Source SHA256: 1a7d9ecffcc45b4ad98255312ca9ba62a424e96d75c3c1926054a5689914af75 -->
 
 # fieldsofrevik-web
 
@@ -31,3 +31,5 @@ Build commands record source and exact regular output hashes. Declared tests pro
 ## Contributor task interface
 
 Contributor tool versions and task entry points live in the native Mise configuration. Use `mise run lint` for source checks, `mise run test` for the applicable behavioral tests, and `mise run check` for the complete supported gate. `mise run clean` removes declared generated outputs while preserving source, credentials and retained data. Use `mise run dev` and `mise run stop` for this checkout's owned local session.
+
+Built exports enforce the product byte limits in `scripts/site-budget.json`: 2 MiB total, 512 KiB per file, 64 KiB gzip HTML per page and 128 KiB gzip JavaScript in aggregate. `mise run artifact-check` checks these actual output bytes alongside metadata and accessible markup. Browser acceptance covers responsive layout, images and keyboard use.
diff --git a/mise.toml b/mise.toml
index d58b85e..3e7581a 100644
--- a/mise.toml
+++ b/mise.toml
@@ -16,7 +16,7 @@ run = "python3 \"$TOOLS_ROOT/helpers/verification.py\" build --name build --arti
 depends = ["install"]
 
 [tasks."artifact-check"]
-run = ["bash scripts/test-site.sh", "python3 \"$TOOLS_ROOT/helpers/site-contract.py\" dist"]
+run = ["bash scripts/test-site.sh", "python3 \"$TOOLS_ROOT/helpers/site-contract.py\" dist --budget scripts/site-budget.json"]
 depends = ["build"]
 
 [tasks."dev"]
diff --git a/scripts/site-budget.json b/scripts/site-budget.json
new file mode 100644
index 0000000..194d280
--- /dev/null
+++ b/scripts/site-budget.json
@@ -0,0 +1,6 @@
+{
+  "max_total_bytes": 2097152,
+  "max_file_bytes": 524288,
+  "max_html_gzip_bytes": 65536,
+  "max_javascript_gzip_bytes": 131072
+}
diff --git a/src/pages/index.astro b/src/pages/index.astro
index 2116192..96e9e23 100644
--- a/src/pages/index.astro
+++ b/src/pages/index.astro
@@ -1,6 +1,6 @@
 ---
 import Layout from '../layouts/Layout.astro';
-import { Image } from 'astro:assets';
+import { Image, getImage } from 'astro:assets';
 import GameTitle from '../components/GameTitle.astro';
 import Button from '../components/Button.astro';
 import { Carousel } from '../components/Carousel';
@@ -38,10 +38,10 @@ const cardArtAssets = [
 ];
 
 // Convert ImageMetadata to URL strings for Qwik component
-const carouselItems = cardArtAssets.map(item => ({
-  src: item.src.src,
+const carouselItems = await Promise.all(cardArtAssets.map(async item => ({
+  src: (await getImage({ src: item.src, width: 512, format: 'webp', quality: 80 })).src,
   name: item.name
-}));
+})));
 ---
 
 <Layout>