diff --git a/scripts/deploy_tower.ps1 b/scripts/deploy_tower.ps1
index 87969140..6c7e378f 100644
--- a/scripts/deploy_tower.ps1
+++ b/scripts/deploy_tower.ps1
@@ -2,7 +2,7 @@ param(
     [string]$RemoteHost = "root@192.168.10.150",
     [string]$RemotePath = "/mnt/user/appdata/geointel",
     [string]$RemoteBranch = "main",
-    [string]$RemoteRepo = "git@gitea.itworx.tech:Jens/geointel.git",
+    [string]$RemoteRepo = "gitea-widefrog:Jens/geointel.git",
     [string]$SshKey = "$HOME/.ssh/itworx_unraid_deploy",
     [string]$FrontendUrl = "http://192.168.10.150:1202",
     [string]$InstallAi = $(if ($env:GEOINTEL_INSTALL_AI) { $env:GEOINTEL_INSTALL_AI } else { "" }),
@@ -42,6 +42,12 @@ git branch -M "$REMOTE_BRANCH"
 git clean -fd -- backend frontend deploy scripts fixtures tests contracts demo
 chmod +x scripts/*.sh backend/docker_start.sh deploy/unraid/*.sh || true
 
+# Persistent runtime roots can legitimately contain untracked files. The
+# deploy checkout nevertheless has an exact, freshly fetched source revision
+# because every image-bearing source path was reset and cleaned above.
+DEPLOY_BUILD_SHA="$(git rev-parse HEAD)"
+
+GEOINTEL_BUILD_SHA="$DEPLOY_BUILD_SHA" \
 FRONTEND_URL="$FRONTEND_URL" \
 DEPLOY_GEOINTEL_INSTALL_AI="${DEPLOY_GEOINTEL_INSTALL_AI:-}" \
 bash deploy/unraid/deploy-release.sh
diff --git a/scripts/deploy_tower.sh b/scripts/deploy_tower.sh
index 56797f8b..4eecc1a6 100644
--- a/scripts/deploy_tower.sh
+++ b/scripts/deploy_tower.sh
@@ -4,7 +4,7 @@ set -euo pipefail
 REMOTE_HOST="${REMOTE_HOST:-root@192.168.10.150}"
 REMOTE_PATH="${REMOTE_PATH:-/mnt/user/appdata/geointel}"
 REMOTE_BRANCH="${REMOTE_BRANCH:-main}"
-REMOTE_REPO="${REMOTE_REPO:-git@gitea.itworx.tech:Jens/geointel.git}"
+REMOTE_REPO="${REMOTE_REPO:-gitea-widefrog:Jens/geointel.git}"
 SSH_KEY="${SSH_KEY:-$HOME/.ssh/itworx_unraid_deploy}"
 FRONTEND_URL="${FRONTEND_URL:-http://192.168.10.150:1202}"
 BOOTSTRAP="${DEPLOY_BOOTSTRAP:-0}"
@@ -45,6 +45,12 @@ git checkout -B "$REMOTE_BRANCH" "origin/$REMOTE_BRANCH"
 git clean -fd -- backend frontend deploy scripts fixtures tests contracts demo
 chmod +x scripts/*.sh backend/docker_start.sh deploy/unraid/*.sh || true
 
+# Persistent runtime roots can legitimately contain untracked files. The
+# deploy checkout nevertheless has an exact, freshly fetched source revision
+# because every image-bearing source path was reset and cleaned above.
+DEPLOY_BUILD_SHA="$(git rev-parse HEAD)"
+
+GEOINTEL_BUILD_SHA="$DEPLOY_BUILD_SHA" \
 FRONTEND_URL="$FRONTEND_URL" \
 DEPLOY_GEOINTEL_INSTALL_AI="${DEPLOY_GEOINTEL_INSTALL_AI:-}" \
 bash deploy/unraid/deploy-release.sh