diff --git a/.gitea/workflows/deploy.yml b/.gitea/workflows/deploy.yml
index a5c7793..a8074e7 100644
--- a/.gitea/workflows/deploy.yml
+++ b/.gitea/workflows/deploy.yml
@@ -38,7 +38,6 @@ jobs:
     if: ${{ vars.DEPLOY_ENABLED == 'true' }}
     outputs:
       image_ref: ${{ steps.tags.outputs.image_ref }}
-      is_tag: ${{ steps.tags.outputs.is_tag }}
     steps:
       - uses: actions/checkout@v4
 
@@ -60,13 +59,11 @@ jobs:
             echo "tags=${BASE}:${TAG},${BASE}:latest" >> "$GITHUB_OUTPUT"
             echo "version=${TAG}" >> "$GITHUB_OUTPUT"
             echo "image_ref=${BASE}:${TAG}" >> "$GITHUB_OUTPUT"
-            echo "is_tag=true" >> "$GITHUB_OUTPUT"
           else
             SHA7="${GITHUB_SHA::7}"
             echo "tags=${BASE}:main,${BASE}:${SHA7}" >> "$GITHUB_OUTPUT"
             echo "version=${SHA7}" >> "$GITHUB_OUTPUT"
             echo "image_ref=${BASE}:main" >> "$GITHUB_OUTPUT"
-            echo "is_tag=false" >> "$GITHUB_OUTPUT"
           fi
 
       - uses: docker/build-push-action@v6
@@ -102,19 +99,19 @@ jobs:
           DEPLOY_HOST: ${{ secrets.DEPLOY_HOST }}
           DEPLOY_PATH: ${{ secrets.DEPLOY_PATH }}
           IMAGE_REF: ${{ needs.build.outputs.image_ref }}
-          IS_TAG: ${{ needs.build.outputs.is_tag }}
         run: |
           REMOTE_CMD='cd "$DEPLOY_PATH" || exit 1
-          if [ "$IS_TAG" = "true" ]; then
-            perl -i -pe "s|^LIBRENOTES_IMAGE=.*|LIBRENOTES_IMAGE=$IMAGE_REF|" .env
-            grep -q "^LIBRENOTES_IMAGE=" .env || echo "LIBRENOTES_IMAGE=$IMAGE_REF" >> .env
-          fi
+          git pull --ff-only
+          # Always pin LIBRENOTES_IMAGE so first deploy works without manual
+          # .env priming and so rollback only ever needs an .env edit.
+          perl -i -pe "s|^LIBRENOTES_IMAGE=.*|LIBRENOTES_IMAGE=$IMAGE_REF|" .env
+          grep -q "^LIBRENOTES_IMAGE=" .env || echo "LIBRENOTES_IMAGE=$IMAGE_REF" >> .env
           docker compose -f compose.yaml -f compose.netcup.yaml pull
           docker compose -f compose.yaml -f compose.netcup.yaml up -d --remove-orphans'
           ssh -i ~/.ssh/id_deploy \
               -o StrictHostKeyChecking=accept-new \
               "$DEPLOY_HOST" \
-              "DEPLOY_PATH='$DEPLOY_PATH' IMAGE_REF='$IMAGE_REF' IS_TAG='$IS_TAG' bash -s" <<< "$REMOTE_CMD"
+              "DEPLOY_PATH='$DEPLOY_PATH' IMAGE_REF='$IMAGE_REF' bash -s" <<< "$REMOTE_CMD"
 
       - name: Verify health
         env: