diff --git a/deploy/deploy.sh b/deploy/deploy.sh
index 5c981b0..b012abd 100755
--- a/deploy/deploy.sh
+++ b/deploy/deploy.sh
@@ -81,7 +81,9 @@ say "Checking .env.production for new variables"
 
 if [ "$BUILD" -eq 1 ]; then
   say "Building image on the LXC (this takes a few minutes)"
-  "${SSH[@]}" "cd $REMOTE_DIR && sudo -n docker build -t $IMAGE ." || die "image build failed"
+  # Pass the build context as a path rather than cd-ing in: the shell runs as the
+  # deploy user, which cannot enter /root even though sudo can build there.
+  "${SSH[@]}" "sudo -n docker build -t $IMAGE $REMOTE_DIR" || die "image build failed"
 fi
 
 if [ "$PUSH" -eq 1 ]; then
@@ -90,8 +92,10 @@ if [ "$PUSH" -eq 1 ]; then
 fi
 
 say "Restarting stack"
-# --no-build: compose must use the image we just built, not try to rebuild or pull.
-"${SSH[@]}" "cd $REMOTE_DIR && sudo -n docker compose -f $COMPOSE_FILE up -d --no-build"
+# --no-build: compose must use the image we just built, not rebuild or pull it.
+# Compose takes the project directory from the compose file's location, which keeps
+# the project name "drinktracker" and so reuses the existing containers and volumes.
+"${SSH[@]}" "sudo -n docker compose -f $REMOTE_DIR/$COMPOSE_FILE up -d --no-build"
 
 # ─── Verify ──────────────────────────────────────────────────────────
 say "Verifying"