diff --git a/docs-site/Makefile b/docs-site/Makefile
index 75d0c99..af563f6 100644
--- a/docs-site/Makefile
+++ b/docs-site/Makefile
@@ -39,21 +39,21 @@ shell: ## Open a shell in the running dev container (debugging)
 
 # ---- Production deploy --------------------------------------------------
 #
-# `make deploy` pulls origin/main on the warehack.ing prod host and rebuilds
-# the docs container. Agent-forwarding (`-A`) lets the remote `git pull` use
-# the operator's local SSH key for Gitea — nothing persistent is provisioned
-# on the deploy host.
+# `make deploy` SSHes to dell01 (where the docs run, behind the shared
+# caddy-docker-proxy), has it pull origin/main from Gitea via the forwarded
+# agent key, and rebuilds the container. Nothing persistent is provisioned.
 #
-# Override DEPLOY_HOST / DEPLOY_PATH for a different deployment without
-# editing this file. The defaults are the warehack.ing cookie-cutter shape
+# `git fetch origin` (bare) — NOT `git fetch origin main`, which only writes
+# FETCH_HEAD, leaving origin/main unresolved so the reset fails on a fresh
+# checkout. Override DEPLOY_HOST / DEPLOY_PATH for a different target.
 # (see ~/.claude/references/warehacking.md).
 
-DEPLOY_HOST ?= warehack-ing@warehack.ing
-DEPLOY_PATH ?= ~/cuckoo-escapement
+DEPLOY_HOST ?= dell01
+DEPLOY_PATH ?= warehack-ing/cuckoo-escapement
 
 .PHONY: deploy
-deploy: ## Pull main + rebuild the docs container on the prod host
-	@echo "==> deploying $(DEPLOY_HOST):$(DEPLOY_PATH)"
-	ssh -A $(DEPLOY_HOST) "cd $(DEPLOY_PATH) && git fetch origin main && git reset --hard origin/main && cd docs-site && make prod"
-	@echo "==> sanity check"
-	@curl -s -o /dev/null -w "    HTTP %{http_code}  %{url_effective}\n" "https://escapement.warehack.ing/explanation/preempt-rt-made-it-worse/"
+deploy: ## Pull origin/main on dell01 + rebuild the docs container
+	@echo "==> deploying on $(DEPLOY_HOST):$(DEPLOY_PATH)"
+	ssh -A $(DEPLOY_HOST) "cd $(DEPLOY_PATH) && git fetch --quiet origin && git reset --hard origin/main && cd docs-site && make prod"
+	@echo "==> sanity check (title of a real page; bogus path should 404)"
+	@curl -sS "https://escapement.warehack.ing/explanation/preempt-rt-made-it-worse/" | grep -oE "<title>[^<]*</title>" || echo "    title not found"