diff --git a/.gitea/workflows/deploy-prod.yml b/.gitea/workflows/deploy-prod.yml
index 7739cd80..83600e39 100644
--- a/.gitea/workflows/deploy-prod.yml
+++ b/.gitea/workflows/deploy-prod.yml
@@ -98,15 +98,17 @@ jobs:
             EXPECTED_SHA="${{ github.event.workflow_run.head_sha }}"
             RELEASE_TAG="${{ steps.fetch.outputs.tag }}"
             RELEASE_SHA="${RELEASE_TAG##*.}"
+            EXPECTED_SHA_SHORT="${EXPECTED_SHA:0:${#RELEASE_SHA}}"
 
-            if [ "$EXPECTED_SHA" != "$RELEASE_SHA" ]; then
+            if [ "$EXPECTED_SHA_SHORT" != "$RELEASE_SHA" ]; then
               echo "ERROR: Release SHA does not match upstream workflow SHA"
               echo "Expected: $EXPECTED_SHA"
+              echo "Expected short: $EXPECTED_SHA_SHORT"
               echo "Release:  $RELEASE_SHA"
               exit 1
             fi
 
-            echo "✓ Release chain verified: $EXPECTED_SHA"
+            echo "✓ Release chain verified: $EXPECTED_SHA_SHORT"
           else
             echo "✓ Workflow dispatch mode — release chain verification skipped"
           fi