diff --git a/docs-site/Makefile b/docs-site/Makefile
index 467d8d0..2983c8f 100644
--- a/docs-site/Makefile
+++ b/docs-site/Makefile
@@ -31,20 +31,21 @@ build: ## Build the static site without bringing up Caddy (CI gate)
 
 # ---- Production deploy --------------------------------------------------
 #
-# Pulls origin/main on the warehack.ing prod host and rebuilds the docs
-# container. Agent forwarding (-A) lets the remote git pull use the
-# operator's key for Gitea, so nothing persistent is provisioned there.
+# The docs site runs on dell01 (behind the shared caddy-docker-proxy). `make
+# deploy` SSHes in with agent forwarding, has dell01 pull origin/main from Gitea
+# (the forwarded key authenticates the fetch), and rebuilds the container.
 #
-# Use docker-2.supportedsystems.net, not warehack.ing: the latter resolves
-# to an IPv4 whose port 22 is unreachable from some networks.
+# `git fetch origin` (bare) — NOT `git fetch origin main`, which only writes
+# FETCH_HEAD, leaving origin/main unresolved so the reset fails on a fresh
+# checkout. See ~/.claude/references/warehacking.md.
 
-DEPLOY_HOST ?= warehack-ing@docker-2.supportedsystems.net
-DEPLOY_PATH ?= ~/mcqemu
+DEPLOY_HOST ?= dell01
+DEPLOY_PATH ?= warehack-ing/mcqemu
 
 .PHONY: deploy
-deploy: ## Pull main + rebuild the docs container on the prod host
-	@echo "==> deploying $(DEPLOY_HOST):$(DEPLOY_PATH)"
-	ssh -A $(DEPLOY_HOST) "cd $(DEPLOY_PATH) && git fetch origin main && git reset --hard origin/main && cd docs-site && make prod"
+deploy: ## Pull origin/main on dell01 + rebuild the docs container
+	@echo "==> deploying on $(DEPLOY_HOST):$(DEPLOY_PATH)"
+	ssh -A $(DEPLOY_HOST) "cd $(DEPLOY_PATH) && git fetch --quiet origin && git reset --hard origin/main && cd docs-site && make prod"
 	@echo "==> verifying by content (these sites return 200 for every path)"
 	@curl -sS https://mcqemu.warehack.ing/ | grep -oE "<title>[^<]*</title>" || echo "    homepage title not found"
 	@curl -sS https://mcqemu.warehack.ing/definitely-not-a-page-xyz/ | grep -oE "<title>[^<]*</title>" || echo "    (bogus path returned no title)"