diff --git a/howto/static-component.md b/howto/static-component.md
index 063f7bf2717ade5ba2374da2c6f8b2fce234d802..79d601bcdd08581e7e4bdcf53e706bb0161f849a 100644
--- a/howto/static-component.md
+++ b/howto/static-component.md
@@ -199,8 +199,17 @@ hosts. Those components are defined in a YAML file in the
 (`modules/roles/misc/static-components.yaml` at the time of writing,
 but it might move to Hiera, see [issue 30020](https://gitlab.torproject.org/tpo/tpa/team/-/issues/30020) and [puppet](puppet)).
 
+The Jenkins server is also used to build and push websites to static
+source servers.
+
+This diagram summarizes how those components talk to each other
+graphically:
+
 ![Static mirrors architecture diagram](static-component/architecture.png)
 
+A narrative of how changes get propagated through the mirror network
+is detailed below.
+
 <!-- this is a rephrased copy of -->
 <!-- https://salsa.debian.org/dsa-team/mirror/dsa-puppet/-/blob/master/modules/roles/README.static-mirroring.txt -->
 
diff --git a/howto/static-component/architecture.dot b/howto/static-component/architecture.dot
index 760420cd61fc9aa55abda8b800823ad191e473f7..fba5d34017fa64498cb66dc99c54ec556e7ed79e 100644
--- a/howto/static-component/architecture.dot
+++ b/howto/static-component/architecture.dot
@@ -14,15 +14,22 @@ digraph static {
                 master:run -> mirror:run [taillabel="runs"]
                 mirror:run -> master:host [label="rsync from"]
                 note [shape="note" label="note:\nthere can be many\n source, master\nand mirror hosts"]
+                git -> jenkins [label="trigger"]
+                jenkins -> git [label="pull"]
+                jenkins -> source:host [label="push"]
         }
         subgraph "clusterusers" {
                 label="users"
                 labelloc=bottom
                 TPA
-                users
+                webdevs
+                public
         }
         TPA -> puppet -> source:host
         puppet -> master:host
         puppet -> mirror:host
-        users -> sudo -> source:update
+        webdevs -> rsync -> source:host
+        webdevs -> sudo -> source:update
+        webdevs -> git
+        public -> mirror:host
 }
diff --git a/howto/static-component/architecture.png b/howto/static-component/architecture.png
index ed8242d1e78feb8b3d7f9bf22151d4a6578dc751..c98f4c100cb95e398f65206b13662ad9dab41feb 100644
Binary files a/howto/static-component/architecture.png and b/howto/static-component/architecture.png differ