diff --git a/.gitea/workflows/deploy.yml b/.gitea/workflows/deploy.yml
index 78e4465..e5b9ad8 100644
--- a/.gitea/workflows/deploy.yml
+++ b/.gitea/workflows/deploy.yml
@@ -11,14 +11,18 @@ jobs:
   # ── BUILD SERVER ──────────────────────────────────────────────────────────────
   build-server:
     runs-on: docker1
+    defaults:
+      run:
+        working-directory: /workspace
     steps:
       - name: Checkout
+        working-directory: /
         run: |
-          if [ -d .git ]; then
-            git fetch origin main
-            git reset --hard origin/main
+          mkdir -p /workspace
+          if [ -d /workspace/.git ]; then
+            cd /workspace && git fetch origin && git reset --hard origin/${{ gitea.ref_name }}
           else
-            git clone ${{ gitea.server_url }}/${{ gitea.repository }}.git .
+            git clone ${{ gitea.server_url }}/${{ gitea.repository }}.git /workspace
           fi
 
       - name: Build & push server
@@ -38,14 +42,18 @@ jobs:
   # ── BUILD WEBCLIENT ───────────────────────────────────────────────────────────
   build-webclient:
     runs-on: docker1
+    defaults:
+      run:
+        working-directory: /workspace
     steps:
       - name: Checkout
+        working-directory: /
         run: |
-          if [ -d .git ]; then
-            git fetch origin main
-            git reset --hard origin/main
+          mkdir -p /workspace
+          if [ -d /workspace/.git ]; then
+            cd /workspace && git fetch origin && git reset --hard origin/${{ gitea.ref_name }}
           else
-            git clone ${{ gitea.server_url }}/${{ gitea.repository }}.git .
+            git clone ${{ gitea.server_url }}/${{ gitea.repository }}.git /workspace
           fi
 
       - name: Build & push webclient
@@ -68,23 +76,15 @@ jobs:
     needs: [build-server, build-webclient]
     if: always() && !failure() && !cancelled()
     steps:
-      - name: Deploy via SSH
+      - name: Deploy
         run: |
-          mkdir -p ~/.ssh
-          echo "${{ secrets.DEPLOY_SSH_KEY }}" > ~/.ssh/deploy_key
-          chmod 600 ~/.ssh/deploy_key
-          ssh-keyscan ${{ secrets.DEPLOY_HOST }} >> ~/.ssh/known_hosts
-
-          ssh -i ~/.ssh/deploy_key ${{ secrets.DEPLOY_USER }}@${{ secrets.DEPLOY_HOST }} bash << 'EOF'
-            set -e
-            mkdir -p /opt/blockly3d
-            cd /opt/blockly3d
-            if [ ! -d .git ]; then
-              git clone https://git.aggtaa.com/anton/blockly3d.git .
-            else
-              git pull origin main
-            fi
-            docker compose pull
-            docker compose up -d --remove-orphans
-            docker image prune -f
-          EOF
+          mkdir -p "/app-cache/${{ gitea.repository }}"
+          cd "/app-cache/${{ gitea.repository }}"
+          if [ ! -d .git ]; then
+            git clone ${{ gitea.server_url }}/${{ gitea.repository }}.git .
+          else
+            git pull origin main
+          fi
+          docker compose pull
+          docker compose up -d --remove-orphans
+          docker image prune -f