diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index d8a230650..5ae7a503f 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -132,7 +132,10 @@ jobs:
           # Exclude _test.go files to stay consistent with .golangci.yml, which
           # excludes gocyclo on test files (test helpers/table-driven tests are
           # allowed higher complexity). Production code is still gated at >10.
-          COMPLEXITY_ISSUES=$(gocyclo -over 10 -ignore "_test\.go" . 2>&1 || true)
+          # Also exclude node_modules/ and vendor/ trees: the `.` walk would
+          # otherwise report third-party Go files that npm packages ship
+          # (e.g. frontend/node_modules/flatted) whenever deps are installed.
+          COMPLEXITY_ISSUES=$(gocyclo -over 10 -ignore "_test\.go|(^|/)(node_modules|vendor)/" . 2>&1 || true)
           if [ -n "$COMPLEXITY_ISSUES" ]; then
             echo "❌ Found functions with cyclomatic complexity over 10:"
             echo "$COMPLEXITY_ISSUES"
diff --git a/Makefile b/Makefile
index f49e1f94a..2ddc3d51a 100644
--- a/Makefile
+++ b/Makefile
@@ -129,7 +129,7 @@ vet:
 complexity:
 	@echo "Checking cyclomatic complexity (threshold: 10)..."
 	@if command -v gocyclo > /dev/null; then \
-		COMPLEXITY_ISSUES=$$(gocyclo -over 10 . 2>&1 || true); \
+		COMPLEXITY_ISSUES=$$(gocyclo -over 10 -ignore '(^|/)(node_modules|vendor)/' . 2>&1 || true); \
 		if [ -n "$$COMPLEXITY_ISSUES" ]; then \
 			echo "❌ Found functions with cyclomatic complexity over 10:"; \
 			echo "$$COMPLEXITY_ISSUES"; \
@@ -149,7 +149,7 @@ complexity:
 complexity-report:
 	@echo "Generating cyclomatic complexity report..."
 	@if command -v gocyclo > /dev/null; then \
-		gocyclo -top 20 . | tee complexity-report.txt; \
+		gocyclo -top 20 -ignore '(^|/)(node_modules|vendor)/' . | tee complexity-report.txt; \
 		echo ""; \
 		echo "📊 Top 20 most complex functions saved to: complexity-report.txt"; \
 	else \