diff --git a/.gitea/workflows/deploy-prod.yml b/.gitea/workflows/deploy-prod.yml
index 26be55c2..6ea16daa 100644
--- a/.gitea/workflows/deploy-prod.yml
+++ b/.gitea/workflows/deploy-prod.yml
@@ -61,7 +61,11 @@ jobs:
 
           RELEASE=$(curl -sf -H "Authorization: token $TOKEN" "$RELEASE_URL")
           TAG=$(echo "$RELEASE" | jq -r '.tag_name')
-          COMMIT=$(echo "$RELEASE" | jq -r '.target_commitish' | cut -c1-7)
+          # NOTE: '.target_commitish' is the branch name the tag was cut from
+          # (e.g. "main"), NOT a commit SHA -- do not use it as a commit hash.
+          # Our tags are always "quant_YYYYMMDD.count.hash" (see
+          # prepare-release.yml), so pull the hash back out of the tag name.
+          COMMIT="${TAG##*.}"
           ARTIFACT=$(echo "$RELEASE" | jq -r '.assets[0].name')
           DOWNLOAD_URL=$(echo "$RELEASE" | jq -r '.assets[0].browser_download_url')
 
@@ -155,16 +159,25 @@ jobs:
           ARTIFACT="${{ steps.fetch.outputs.artifact }}"
           RELEASE_TAG="${{ steps.fetch.outputs.tag }}"
           COMMIT="${{ steps.fetch.outputs.commit }}"
+          SERVICE_NAME="${{ env.SERVICE_NAME }}"
 
+          # IMPORTANT: the heredoc below uses a QUOTED delimiter ('REMOTE'),
+          # so none of $ARTIFACT/$RELEASE_TAG/etc inside it are expanded by
+          # this (local runner) shell -- they must arrive as real
+          # environment variables on the remote bash process instead. The
+          # previous version of this script had the same quoted heredoc but
+          # relied on local expansion anyway, so every deploy printed the
+          # literal text "$ARTIFACT" and then failed on
+          # "tar: /tmp/$ARTIFACT: No such file or directory". Passing them
+          # as a prefix to `bash -s` is what actually gets them into the
+          # remote script's environment.
           ssh -i ~/.ssh/deploy_key \
             -p ${{ env.DEPLOY_PORT }} \
             -o StrictHostKeyChecking=accept-new \
-            ${{ env.DEPLOY_USER }}@${{ env.DEPLOY_HOST }} bash << 'REMOTE'
+            ${{ env.DEPLOY_USER }}@${{ env.DEPLOY_HOST }} \
+            "ARTIFACT='$ARTIFACT' RELEASE_TAG='$RELEASE_TAG' COMMIT='$COMMIT' SERVICE_NAME='$SERVICE_NAME' bash -s" << 'REMOTE'
           set -e
 
-          ARTIFACT='$ARTIFACT'
-          RELEASE_TAG='$RELEASE_TAG'
-          COMMIT='$COMMIT'
           DEPLOY_HOME=$HOME
           DEPLOY_DIR="$DEPLOY_HOME/deployments/quantengine_${RELEASE_TAG}_${COMMIT}"
 
@@ -205,7 +218,7 @@ jobs:
           # 4. Restart Service
           echo ""
           echo "【 4/4 Restart Service 】"
-          sudo systemctl restart $SERVICE_NAME
+          sudo systemctl restart "$SERVICE_NAME"
           echo "✓ Service restarted"
 
           REMOTE