diff --git a/README.md b/README.md
index 09e8fd1..b770aa1 100644
--- a/README.md
+++ b/README.md
@@ -101,4 +101,7 @@ State `pmg.update` выполняет:
 Коротко про `pmg.custom_check`:
 - готовит окружение (`pwgen`, `/var/log/mail_av`, `/usr/local/bin/pmg-custom-check`);
 - готовит Kaspersky-учетку (`pmg.custom_check.ksc_superuser.*`; сейчас `superuser` + `NOPASSWD`);
+- настраивает исключения KESL из сканирования через `pmg.custom_check.kesl_excluded_paths`
+  (по умолчанию: `/var/spool/pmg`, `/var/lib/clamav`, `/tmp/.proxdump_*`) и делает
+  `systemctl restart kesl` только при изменении этих настроек;
 - если `kesl/klnagent64` установлены — включает сервисы и `custom_check` в PMG, если нет — выводит уведомление "ставится через Kaspersky Administration Center"; сервисы включатся вторым прогоном после установки пакетов.
diff --git a/pillar/pmg.sls b/pillar/pmg.sls
index af646a9..ddadf4c 100644
--- a/pillar/pmg.sls
+++ b/pillar/pmg.sls
@@ -53,6 +53,10 @@ pmg:
     required_services:
       - kesl
       - klnagent64
+    kesl_excluded_paths:
+      - /var/spool/pmg
+      - /var/lib/clamav
+      - /tmp/.proxdump_*
 
   manage_hosts_file: false
   hosts_file_entries:
diff --git a/pmg/custom_check.sls b/pmg/custom_check.sls
index 8b612f1..e6a62a4 100644
--- a/pmg/custom_check.sls
+++ b/pmg/custom_check.sls
@@ -3,6 +3,7 @@
 {% set custom_check_log_dir = salt['pillar.get']('pmg:custom_check:log_dir', '/var/log/mail_av') %}
 {% set custom_check_managed_packages = salt['pillar.get']('pmg:custom_check:managed_packages', ['pwgen']) %}
 {% set custom_check_required_services = salt['pillar.get']('pmg:custom_check:required_services', ['kesl', 'klnagent64']) %}
+{% set custom_check_kesl_excluded_paths = salt['pillar.get']('pmg:custom_check:kesl_excluded_paths', ['/var/spool/pmg', '/var/lib/clamav', '/tmp/.proxdump_*']) %}
 {% set ksc_superuser_enabled = salt['pillar.get']('pmg:custom_check:ksc_superuser:enabled', False) %}
 {% set ksc_superuser_name = salt['pillar.get']('pmg:custom_check:ksc_superuser:name', '') %}
 {% set ksc_superuser_manage_sudoers = salt['pillar.get']('pmg:custom_check:ksc_superuser:manage_sudoers', True) %}
@@ -93,6 +94,34 @@ pmg-custom-check-service-{{ service_name }}:
       - test: pmg-custom-check-kaspersky-ready
 {% endfor %}
 
+{% for excluded_path in custom_check_kesl_excluded_paths %}
+pmg-custom-check-kesl-excluded-scope-{{ loop.index0 }}:
+  cmd.run:
+    - name: >-
+        kesl-control --set-settings File_Threat_Protection
+        ExcludedFromScanScope.item_{{ "%04d" | format(loop.index0) }}.Path='{{ excluded_path }}'
+        ExcludedFromScanScope.item_{{ "%04d" | format(loop.index0) }}.UseScanArea=Yes
+        ExcludedFromScanScope.item_{{ "%04d" | format(loop.index0) }}.AreaMask.item_0000='*'
+    - unless: >-
+        kesl-control --get-settings File_Threat_Protection 2>/dev/null
+        | grep -Fq "ExcludedFromScanScope.item_{{ "%04d" | format(loop.index0) }}.Path={{ excluded_path }}"
+    - require:
+      - test: pmg-custom-check-kaspersky-ready
+{% for service_name in custom_check_required_services %}
+      - service: pmg-custom-check-service-{{ service_name }}
+{% endfor %}
+{% endfor %}
+
+pmg-custom-check-kesl-restart:
+  cmd.wait:
+    - name: systemctl restart kesl
+    - watch:
+{% for excluded_path in custom_check_kesl_excluded_paths %}
+      - cmd: pmg-custom-check-kesl-excluded-scope-{{ loop.index0 }}
+{% endfor %}
+    - require:
+      - test: pmg-custom-check-kaspersky-ready
+
 pmg-custom-check-enable-in-pmg:
   cmd.run:
     - name: pmgsh set /config/admin --custom_check 1