diff --git a/.gitea/workflows/deploy-prod.yml b/.gitea/workflows/deploy-prod.yml
index cfd7c566..23cce7bd 100644
--- a/.gitea/workflows/deploy-prod.yml
+++ b/.gitea/workflows/deploy-prod.yml
@@ -315,7 +315,14 @@ jobs:
               # 2026-07-12: this check would have caught it, the HTTP check alone
               # did not.)
               sleep 2
-              DB_ERRORS=$(journalctl -u quantengine --since '1 minute ago' --no-pager 2>/dev/null | grep -c '28P01\|password authentication failed' || echo "0")
+              # NOTE: `grep -c` exits 1 when the count is 0 (no matches),
+              # even though it correctly prints "0". Combined with
+              # `|| echo "0"`, a healthy zero-error result triggered BOTH
+              # grep's own "0" output AND the fallback's "0", producing a
+              # two-line "0\n0" that never equals the string "0" below.
+              # Use `|| true` instead, which only neutralizes the exit
+              # code without adding a second line.
+              DB_ERRORS=$(journalctl -u quantengine --since '1 minute ago' --no-pager 2>/dev/null | grep -c '28P01\|password authentication failed' || true)
               if [ "$DB_ERRORS" = "0" ]; then
                 echo "✓ [6/6] No DB authentication errors in recent logs"
               else