diff --git a/cdk/po_stack.py b/cdk/po_stack.py
index dde358e..cf0ea33 100644
--- a/cdk/po_stack.py
+++ b/cdk/po_stack.py
@@ -159,14 +159,8 @@ class PoIngestStack(Stack):
             billing_mode=dynamodb.BillingMode.PAY_PER_REQUEST,
             removal_policy=RemovalPolicy.RETAIN,
         )
-        verified_sites_table.add_global_secondary_index(
-            index_name="by-state",
-            partition_key=dynamodb.Attribute(
-                name="state",
-                type=dynamodb.AttributeType.STRING,
-            ),
-            projection_type=dynamodb.ProjectionType.ALL,
-        )
+        # by-state GSI removed 2026-06-03 (audit M-20): 0 reads in 30d against
+        # 518 WCU of write amplification. Re-add if a state-level query path ships.
 
         # --- Site extractor Lambda (DynamoDB Streams → verified-sites) ---
         site_extractor = lambda_.Function(
diff --git a/cdk/wo_stack.py b/cdk/wo_stack.py
index dd29781..37355ac 100644
--- a/cdk/wo_stack.py
+++ b/cdk/wo_stack.py
@@ -44,28 +44,9 @@ class WorkorderIngestStack(Stack):
             billing_mode=dynamodb.BillingMode.PAY_PER_REQUEST,
             removal_policy=RemovalPolicy.RETAIN,
         )
-        work_orders_table.add_global_secondary_index(
-            index_name="site-code-index",
-            partition_key=dynamodb.Attribute(
-                name="site_code",
-                type=dynamodb.AttributeType.STRING,
-            ),
-            sort_key=dynamodb.Attribute(
-                name="updated_at",
-                type=dynamodb.AttributeType.STRING,
-            ),
-        )
-        work_orders_table.add_global_secondary_index(
-            index_name="status-index",
-            partition_key=dynamodb.Attribute(
-                name="wo_status",
-                type=dynamodb.AttributeType.STRING,
-            ),
-            sort_key=dynamodb.Attribute(
-                name="updated_at",
-                type=dynamodb.AttributeType.STRING,
-            ),
-        )
+        # site-code-index and status-index GSIs removed 2026-06-03 (audit M-20):
+        # 0 reads in 30d against ~50k WCU each of write amplification. Re-add if
+        # a site-code or status query path ships.
 
         comments_table = dynamodb.Table(
             self,