diff --git a/.gitea/workflows/ci-deploy.yml b/.gitea/workflows/ci-deploy.yml
index a2366f9..1f306d7 100644
--- a/.gitea/workflows/ci-deploy.yml
+++ b/.gitea/workflows/ci-deploy.yml
@@ -48,18 +48,6 @@ jobs:
     if: github.event_name == 'push' && github.ref == 'refs/heads/main'
     runs-on: ubuntu-latest
     steps:
-      - name: Checkout
-        uses: actions/checkout@v4
-
-      - name: Upload deploy bundle to server
-        uses: appleboy/scp-action@v0.1.7
-        with:
-          host: ${{ secrets.PROD_HOST }}
-          username: ${{ secrets.PROD_USER }}
-          key: ${{ secrets.PROD_SSH_KEY }}
-          source: "."
-          target: "/opt/job-tracker/app"
-
       - name: Run remote deploy
         uses: appleboy/ssh-action@v1.0.3
         with:
@@ -67,7 +55,14 @@ jobs:
           username: ${{ secrets.PROD_USER }}
           key: ${{ secrets.PROD_SSH_KEY }}
           script: |
+            if [ ! -d /opt/job-tracker/app/.git ]; then
+              echo "Expected git checkout at /opt/job-tracker/app but .git was not found."
+              exit 1
+            fi
             cd /opt/job-tracker/app
+            git fetch --all --prune
+            git reset --hard ${{ github.sha }}
+            git clean -fd
             chmod +x deploy/deploy.sh
             APP_VERSION=${{ github.run_number }} \
             APP_COMMIT_SHA=${{ github.sha }} \