diff --git a/.gitea/workflows/deploy.yml b/.gitea/workflows/deploy.yml
index 4cdf909..bd1ebdd 100644
--- a/.gitea/workflows/deploy.yml
+++ b/.gitea/workflows/deploy.yml
@@ -1,14 +1,14 @@
-# Push to main → scp backend sources to ark-library-backend-1, rebuild api.
+# Push to main → scp backend sources to API host, rebuild api container.
 #
-# Gitea repo secrets (Settings → Actions → Secrets):
-#   DEPLOY_SSH_KEY   — PEM private key for ec2-user@ark-library-backend-1 (no passphrase)
+# ark-library-backend-1 is a *local* SSH alias only. The act runner cannot resolve it.
+# Default host is the Tailscale IP from ~/.ssh/config (Host ark-library-backend-1 → 100.93.205.19).
+# The Gitea act runner must be on the same Tailscale tailnet, OR set secret DEPLOY_HOST to a reachable IP/DNS.
 #
-# Optional secrets (override defaults):
-#   DEPLOY_HOST      — SSH host (default ark-library-backend-1)
-#   DEPLOY_USER      — default ec2-user
-#   REMOTE_REPO      — default /home/ec2-user/arkieproject
-#
-# Runner must reach the host. Server needs ${REMOTE_REPO}/.env and deploy/ (bootstrap via deploy/sync-admin.sh).
+# Secrets (Settings → Actions → Secrets):
+#   DEPLOY_SSH_KEY   — required: ark-library.pem contents (ec2-user, no passphrase)
+#   DEPLOY_HOST      — optional: override default 100.93.205.19
+#   DEPLOY_USER      — optional: default ec2-user
+#   REMOTE_REPO      — optional: default /home/ec2-user/arkieproject
 
 name: Deploy API
 
@@ -31,10 +31,13 @@ jobs:
 
       - name: Resolve deploy target
         run: |
-          echo "DEPLOY_HOST=${DEPLOY_HOST:-ark-library-backend-1}" >> "$GITHUB_ENV"
+          # Tailscale IP for ark-library-backend-1 (see ~/.ssh/config on dev machine)
+          host="${DEPLOY_HOST:-100.93.205.19}"
+          repo="${REMOTE_REPO:-/home/ec2-user/arkieproject}"
+          echo "DEPLOY_HOST=${host}" >> "$GITHUB_ENV"
           echo "DEPLOY_USER=${DEPLOY_USER:-ec2-user}" >> "$GITHUB_ENV"
-          echo "REMOTE_REPO=${REMOTE_REPO:-/home/ec2-user/arkieproject}" >> "$GITHUB_ENV"
-          echo "REMOTE_BACKEND=${REMOTE_REPO:-/home/ec2-user/arkieproject}/backend" >> "$GITHUB_ENV"
+          echo "REMOTE_REPO=${repo}" >> "$GITHUB_ENV"
+          echo "REMOTE_BACKEND=${repo}/backend" >> "$GITHUB_ENV"
 
       - name: Configure SSH
         env:
@@ -47,16 +50,24 @@ jobs:
           install -d -m 700 ~/.ssh
           printf '%s\n' "${DEPLOY_SSH_KEY}" > ~/.ssh/deploy_key
           chmod 600 ~/.ssh/deploy_key
-          ssh-keyscan -H "${DEPLOY_HOST}" >> ~/.ssh/known_hosts 2>/dev/null || true
-          cat >> ~/.ssh/config <<EOF
-          Host deploy-target
-            HostName ${DEPLOY_HOST}
-            User ${DEPLOY_USER}
-            IdentityFile ~/.ssh/deploy_key
-            StrictHostKeyChecking accept-new
-            ConnectTimeout 30
-          EOF
+          {
+            echo "Host deploy-target"
+            echo "  HostName ${DEPLOY_HOST}"
+            echo "  User ${DEPLOY_USER}"
+            echo "  IdentityFile ~/.ssh/deploy_key"
+            echo "  StrictHostKeyChecking accept-new"
+            echo "  ConnectTimeout 30"
+          } >> ~/.ssh/config
           chmod 600 ~/.ssh/config
+          ssh-keyscan -H "${DEPLOY_HOST}" >> ~/.ssh/known_hosts 2>/dev/null || true
+
+      - name: Verify SSH reachability
+        run: |
+          echo "Testing SSH to ${DEPLOY_USER}@${DEPLOY_HOST} ..."
+          if ! ssh -o BatchMode=yes -o ConnectTimeout=15 deploy-target "echo ok" 2>&1; then
+            echo "::error::Cannot SSH to ${DEPLOY_HOST}. The act runner must reach this host (same Tailscale tailnet, or set DEPLOY_HOST secret to a public IP/DNS). Local alias ark-library-backend-1 does not work on CI."
+            exit 1
+          fi
 
       - name: Package backend sources
         run: |
@@ -71,7 +82,7 @@ jobs:
 
       - name: Deploy backend sources (scp)
         run: |
-          scp /tmp/backend-deploy.tar.gz deploy-target:/tmp/backend-deploy.tar.gz
+          scp -o ConnectTimeout=30 /tmp/backend-deploy.tar.gz deploy-target:/tmp/backend-deploy.tar.gz
           ssh deploy-target bash -s <<REMOTE
           set -euo pipefail
           REMOTE_BACKEND="${REMOTE_BACKEND}"