diff --git a/deploy/deploy.sh b/deploy/deploy.sh
index 3bef7e3..604ce8e 100755
--- a/deploy/deploy.sh
+++ b/deploy/deploy.sh
@@ -31,6 +31,14 @@ SSH=(ssh -o BatchMode=yes -o ConnectTimeout=10 -i "$SSH_KEY" "$HOST")
 say() { printf '\n\033[1;36m==> %s\033[0m\n' "$*"; }
 die() { printf '\n\033[1;31mFAILED: %s\033[0m\n' "$*" >&2; exit 1; }
 
+# Run a script (on stdin) as root on the LXC, with these vars exported.
+# sudoers grants drinkadmin NOPASSWD only as root, so we sudo once and `su` down
+# to the service user inside rather than using `sudo -u`.
+remote_root() {
+  "${SSH[@]}" "sudo -n env APP_DIR='$APP_DIR' SVC_USER='$SVC_USER' SHA='${SHA:-}' \
+    SHORT='${SHORT:-}' KEEP='$KEEP_RELEASES' bash -s"
+}
+
 health_poll() {
   for i in $(seq 1 30); do
     code=$("${SSH[@]}" "curl -s -o /dev/null -w '%{http_code}' -m 5 $HEALTH_URL" || echo 000)
@@ -43,17 +51,19 @@ health_poll() {
 
 # ─── Rollback: repoint the symlink, no rebuild ───────────────────────
 if [ "$ROLLBACK" -eq 1 ]; then
-  say "Available releases (newest last)"
-  "${SSH[@]}" "ls -1tr $APP_DIR/releases"
-  CURRENT=$("${SSH[@]}" "readlink $APP_DIR/current | xargs basename")
+  say "Rolling back"
+  CURRENT=$("${SSH[@]}" "basename \$(readlink $APP_DIR/current)")
   PREV=$("${SSH[@]}" "ls -1t $APP_DIR/releases | grep -v '^$CURRENT\$' | head -1")
   [ -n "$PREV" ] || die "no other release to roll back to"
-  echo "  current=$CURRENT  ->  rolling back to $PREV"
+  echo "  current=$CURRENT  ->  $PREV"
   if [ "$ASSUME_YES" -ne 1 ]; then
     read -r -p "  proceed? [y/N] " r; [[ "$r" =~ ^[Yy]$ ]] || { echo aborted; exit 1; }
   fi
-  "${SSH[@]}" "sudo -n -u $SVC_USER bash -c 'ln -sfn $APP_DIR/releases/$PREV $APP_DIR/current.new && mv -Tf $APP_DIR/current.new $APP_DIR/current'"
-  "${SSH[@]}" "sudo -n systemctl restart drinktracker"
+  SHORT="$PREV" remote_root <<'EOF'
+set -e
+su -s /bin/bash "$SVC_USER" -c "ln -sfn $APP_DIR/releases/$SHORT $APP_DIR/current.new && mv -Tf $APP_DIR/current.new $APP_DIR/current"
+systemctl restart drinktracker
+EOF
   health_poll || die "app unhealthy after rollback - journalctl -u drinktracker"
   say "Rolled back to $PREV"
   exit 0
@@ -82,67 +92,73 @@ for unit in postgresql@16-main minio drinktracker; do
 done
 
 if [ "$ASSUME_YES" -ne 1 ]; then
-  CURRENT=$("${SSH[@]}" "readlink $APP_DIR/current | xargs basename")
+  CURRENT=$("${SSH[@]}" "basename \$(readlink $APP_DIR/current)")
   echo "  current release $CURRENT, deploying $SHORT"
   read -r -p "  proceed? [y/N] " r; [[ "$r" =~ ^[Yy]$ ]] || { echo aborted; exit 1; }
 fi
 
-# ─── Build (out-of-place; the running release keeps serving) ─────────
-say "Syncing and building on $HOST"
-"${SSH[@]}" "sudo -n -u $SVC_USER git -C $APP_DIR/repo fetch --quiet origin main && sudo -n -u $SVC_USER git -C $APP_DIR/repo reset --hard $SHA --quiet && sudo -n -u $SVC_USER git -C $APP_DIR/repo log --oneline -1"
+# ─── Build and assemble (out-of-place; old release keeps serving) ────
+say "Syncing, building and assembling $SHORT"
+BUILD="$BUILD" remote_root <<'EOF'
+set -e
+su -s /bin/bash "$SVC_USER" <<INNER
+set -e
+git -C "$APP_DIR/repo" fetch --quiet origin main
+git -C "$APP_DIR/repo" reset --hard "$SHA" --quiet
+git -C "$APP_DIR/repo" log --oneline -1
 
-if [ "$BUILD" -eq 1 ]; then
-  # Built WITHOUT the env file, deliberately - same as the Dockerfile. next.config.mjs
-  # evaluates rewrites() at build time, so sourcing the env here would bake a different
-  # /minio-images destination into routes-manifest.json.
-  "${SSH[@]}" "sudo -n -u $SVC_USER bash -lc '
-    set -e
-    cd $APP_DIR/repo
-    export npm_config_cache=$APP_DIR/.npm NODE_OPTIONS=--max-old-space-size=3072
-    npm ci --prefer-offline --no-audit --fund=false
-    npx prisma generate
-    npm run build
-  '" || die "build failed"
-fi
+cd "$APP_DIR/repo"
+export npm_config_cache="$APP_DIR/.npm" NODE_OPTIONS=--max-old-space-size=3072
+# Built WITHOUT the env file, deliberately - same as the Dockerfile. next.config.mjs
+# evaluates rewrites() at build time, so sourcing the env here would bake a different
+# /minio-images destination into routes-manifest.json.
+npm ci --prefer-offline --no-audit --fund=false
+npx prisma generate
+npm run build
 
-say "Assembling release $SHORT"
 # Mirrors Dockerfile:24-30 - standalone bundle plus static and public copied in.
-"${SSH[@]}" "sudo -n -u $SVC_USER bash -lc '
-  set -e
-  REL=$APP_DIR/releases/$SHORT
-  rm -rf \$REL && mkdir -p \$REL/.next/cache
-  cp -a $APP_DIR/repo/.next/standalone/. \$REL/
-  cp -a $APP_DIR/repo/.next/static \$REL/.next/static
-  cp -a $APP_DIR/repo/public \$REL/public
-  du -sh \$REL
-'" || die "release assembly failed"
+REL="$APP_DIR/releases/$SHORT"
+rm -rf "\$REL" && mkdir -p "\$REL/.next/cache"
+cp -a "$APP_DIR/repo/.next/standalone/." "\$REL"/
+cp -a "$APP_DIR/repo/.next/static" "\$REL/.next/static"
+cp -a "$APP_DIR/repo/public" "\$REL/public"
+du -sh "\$REL"
+INNER
+EOF
+[ "${PIPESTATUS[0]:-0}" -eq 0 ] || die "build/assembly failed"
 
 # ─── Schema ──────────────────────────────────────────────────────────
-say "Backing up database before schema push"
-"${SSH[@]}" "sudo -n install -d -m 0750 /var/backups/drinktracker && sudo -n -u postgres pg_dump drinkman | gzip -9 | sudo -n tee /var/backups/drinktracker/pre-$SHORT.sql.gz >/dev/null && sudo -n ls -lh /var/backups/drinktracker/pre-$SHORT.sql.gz"
+say "Backing up database, then applying schema"
+remote_root <<'EOF'
+set -e
+install -d -m 0750 /var/backups/drinktracker
+sudo -u postgres pg_dump drinkman | gzip -9 > "/var/backups/drinktracker/pre-$SHORT.sql.gz"
+ls -lh "/var/backups/drinktracker/pre-$SHORT.sql.gz"
 
-say "Applying schema"
 # db push, NOT migrate deploy: production has no _prisma_migrations table, so
 # migrate deploy would try to apply the init migration against populated tables.
 # --accept-data-loss means removing a field from schema.prisma DROPS the column.
-"${SSH[@]}" "sudo -n -u $SVC_USER bash -lc '
-  set -a; . /etc/drinktracker/drinktracker.env; set +a
-  cd $APP_DIR/repo && npx prisma db push --skip-generate --accept-data-loss
-'" || die "prisma db push failed"
+su -s /bin/bash "$SVC_USER" -c "set -a; . /etc/drinktracker/drinktracker.env; set +a; cd $APP_DIR/repo && npx prisma db push --skip-generate --accept-data-loss"
+EOF
+[ "${PIPESTATUS[0]:-0}" -eq 0 ] || die "schema step failed"
 
 # ─── Swap and restart ────────────────────────────────────────────────
 say "Swapping to $SHORT and restarting"
-"${SSH[@]}" "sudo -n -u $SVC_USER bash -c 'ln -sfn $APP_DIR/releases/$SHORT $APP_DIR/current.new && mv -Tf $APP_DIR/current.new $APP_DIR/current'"
-"${SSH[@]}" "sudo -n systemctl restart drinktracker"
-health_poll || die "app unhealthy - check: ${SSH[*]} 'journalctl -u drinktracker -n 50'"
+remote_root <<'EOF'
+set -e
+su -s /bin/bash "$SVC_USER" -c "ln -sfn $APP_DIR/releases/$SHORT $APP_DIR/current.new && mv -Tf $APP_DIR/current.new $APP_DIR/current"
+systemctl restart drinktracker
+EOF
+health_poll || die "app unhealthy - check: ${SSH[*]} 'sudo journalctl -u drinktracker -n 50'"
 
-# ─── Verify ──────────────────────────────────────────────────────────
+# ─── Verify and prune ────────────────────────────────────────────────
 say "Verifying"
 "${SSH[@]}" "curl -s -o /dev/null -w '  public=%{http_code}\n' -m 15 https://drinktracker.tenseconddelay.net/ || true"
-"${SSH[@]}" "sudo -n journalctl -u drinktracker --since '2 min ago' | grep '\[switchboard\]' | tail -3 || echo '  (no AI calls yet)'"
-
-say "Pruning old releases (keeping $KEEP_RELEASES)"
-"${SSH[@]}" "sudo -n -u $SVC_USER bash -c 'cd $APP_DIR/releases && ls -1t | tail -n +$((KEEP_RELEASES+1)) | xargs -r rm -rf; ls -1t'"
+remote_root <<'EOF'
+journalctl -u drinktracker --since '3 min ago' | grep '\[switchboard\]' | tail -3 || echo "  (no AI calls in window)"
+cd "$APP_DIR/releases" && ls -1t | tail -n +$((KEEP+1)) | xargs -r rm -rf
+echo "  releases kept:"; ls -1t "$APP_DIR/releases" | sed 's/^/    /'
+EOF
 
 say "Deployed $SHORT"
 echo "Roll back with:  ./deploy/deploy.sh --rollback"