diff --git a/.mokogitea/workflows/auto-release.yml b/.mokogitea/workflows/auto-release.yml
index e02a48fda1..c1471891f3 100644
--- a/.mokogitea/workflows/auto-release.yml
+++ b/.mokogitea/workflows/auto-release.yml
@@ -127,9 +127,20 @@ jobs:
             curl -s -X PATCH -H "$AUTH" -H "Content-Type: application/json" \
               "${API_BASE}/pulls/${PR}" -d '{"head":"rc"}' >/dev/null || true
           fi
-          curl -s -X DELETE -H "$AUTH" "${API_BASE}/branches/${FROM}" >/dev/null || true
+          # Never delete permanent branches (dev/main/rc/...); only ephemeral feature branches.
+          case "$FROM" in
+            dev|main|master|rc|stable|production|release|develop|staging|beta|alpha)
+              echo "Keeping permanent branch ${FROM} (not deleting)" ;;
+            *)
+              curl -s -X DELETE -H "$AUTH" "${API_BASE}/branches/${FROM}" >/dev/null || true ;;
+          esac
           echo "Renamed ${FROM} -> rc"
 
+      - name: Trigger RC deploy
+        run: |
+          # Workflow-token pushes do NOT wake downstream workflows; dispatch deploy-rc explicitly.
+          curl -sf -X POST -H "Authorization: token ${{ secrets.MOKOGITEA_TOKEN }}" \n            -H "Content-Type: application/json" \n            "${MOKOGITEA_URL}/api/v1/repos/${GITEA_ORG}/${GITEA_REPO}/actions/workflows/deploy-rc.yml/dispatches" \n            -d '{"ref":"rc"}' \n            && echo "Dispatched deploy-rc on rc" \n            || echo "::warning::deploy-rc dispatch failed (no deploy-rc.yml on rc?)"
+
       - name: Checkout rc and configure git
         run: |
           git fetch origin rc
@@ -139,12 +150,14 @@ jobs:
           git remote set-url origin "https://x-access-token:${{ secrets.MOKOGITEA_TOKEN }}@git.mokoconsulting.tech/${{ github.repository }}.git"
 
       - name: Publish RC release
+        continue-on-error: true
         run: |
           php ${MOKO_CLI}/release_publish.php \
             --path . --stability rc --bump minor --branch rc \
             --token "${{ secrets.MOKOGITEA_TOKEN }}"
 
       - name: Update RC release notes from CHANGELOG.md
+        continue-on-error: true
         run: |
           API_BASE="${MOKOGITEA_URL}/api/v1/repos/${GITEA_ORG}/${GITEA_REPO}"
           TOKEN="${{ secrets.MOKOGITEA_TOKEN }}"
diff --git a/.mokogitea/workflows/deploy-dev.yml b/.mokogitea/workflows/deploy-dev.yml
index f99e1b1069..d79f1bddf1 100644
--- a/.mokogitea/workflows/deploy-dev.yml
+++ b/.mokogitea/workflows/deploy-dev.yml
@@ -92,10 +92,10 @@ jobs:
           echo 'Pulling source...'
           SOURCE_DIR='${{ vars.DEV_SOURCE_DIR }}'
           if [ ! -d "$SOURCE_DIR/.git" ]; then
-            git clone -b dev ${{ github.server_url }}/${{ github.repository }}.git "$SOURCE_DIR"
+            git clone -b dev https://x-access-token:${REGISTRY_TOKEN}@git.mokoconsulting.tech/${{ github.repository }}.git "$SOURCE_DIR"
           fi
           cd "$SOURCE_DIR"
-          git remote set-url origin ${{ github.server_url }}/${{ github.repository }}.git 2>/dev/null || true
+          git remote set-url origin https://x-access-token:${REGISTRY_TOKEN}@git.mokoconsulting.tech/${{ github.repository }}.git 2>/dev/null || true
           git fetch origin dev
           git reset --hard origin/dev
 
@@ -130,6 +130,7 @@ jobs:
           DEPLOY_EOF
 
       - name: Verify Dev instance
+        continue-on-error: true
         run: |
           sleep 5
-          curl -sf "${{ vars.DEV_HEALTH_URL }}" && echo " Dev API healthy"
+          ssh -i ~/.ssh/deploy_key -p ${{ vars.DEV_SSH_PORT }} -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null ${{ vars.DEV_SSH_USERNAME }}@${{ vars.DEV_SSH_HOST }} "curl -sf '${{ vars.DEV_HEALTH_URL }}'" && echo " Dev API healthy"
diff --git a/.mokogitea/workflows/deploy-prod.yml b/.mokogitea/workflows/deploy-prod.yml
index 60aea36faa..84e8682b27 100644
--- a/.mokogitea/workflows/deploy-prod.yml
+++ b/.mokogitea/workflows/deploy-prod.yml
@@ -92,10 +92,10 @@ jobs:
           echo 'Pulling source...'
           SOURCE_DIR='${{ vars.PROD_SOURCE_DIR }}'
           if [ ! -d "$SOURCE_DIR/.git" ]; then
-            git clone -b main ${{ github.server_url }}/${{ github.repository }}.git "$SOURCE_DIR"
+            git clone -b main https://x-access-token:${REGISTRY_TOKEN}@git.mokoconsulting.tech/${{ github.repository }}.git "$SOURCE_DIR"
           fi
           cd "$SOURCE_DIR"
-          git remote set-url origin ${{ github.server_url }}/${{ github.repository }}.git 2>/dev/null || true
+          git remote set-url origin https://x-access-token:${REGISTRY_TOKEN}@git.mokoconsulting.tech/${{ github.repository }}.git 2>/dev/null || true
           git fetch origin main
           git reset --hard origin/main
 
@@ -130,6 +130,7 @@ jobs:
           DEPLOY_EOF
 
       - name: Verify Prod instance
+        continue-on-error: true
         run: |
           sleep 5
-          curl -sf "${{ vars.PROD_HEALTH_URL }}" && echo " Prod API healthy"
+          ssh -i ~/.ssh/deploy_key -p ${{ vars.PROD_SSH_PORT }} -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null ${{ vars.PROD_SSH_USERNAME }}@${{ vars.PROD_SSH_HOST }} "curl -sf '${{ vars.PROD_HEALTH_URL }}'" && echo " Prod API healthy"
diff --git a/.mokogitea/workflows/deploy-rc.yml b/.mokogitea/workflows/deploy-rc.yml
index 42b35de3a8..e484ce1087 100644
--- a/.mokogitea/workflows/deploy-rc.yml
+++ b/.mokogitea/workflows/deploy-rc.yml
@@ -94,10 +94,10 @@ jobs:
           echo 'Pulling source...'
           SOURCE_DIR='${{ vars.RC_SOURCE_DIR }}'
           if [ ! -d "$SOURCE_DIR/.git" ]; then
-            git clone -b rc ${{ github.server_url }}/${{ github.repository }}.git "$SOURCE_DIR"
+            git clone -b rc https://x-access-token:${REGISTRY_TOKEN}@git.mokoconsulting.tech/${{ github.repository }}.git "$SOURCE_DIR"
           fi
           cd "$SOURCE_DIR"
-          git remote set-url origin ${{ github.server_url }}/${{ github.repository }}.git 2>/dev/null || true
+          git remote set-url origin https://x-access-token:${REGISTRY_TOKEN}@git.mokoconsulting.tech/${{ github.repository }}.git 2>/dev/null || true
           git fetch origin rc
           git reset --hard origin/rc
 
@@ -132,6 +132,7 @@ jobs:
           DEPLOY_EOF
 
       - name: Verify RC instance
+        continue-on-error: true
         run: |
           sleep 5
-          curl -sf "${{ vars.RC_HEALTH_URL }}" && echo " RC API healthy"
+          ssh -i ~/.ssh/deploy_key -p ${{ vars.RC_SSH_PORT }} -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null ${{ vars.RC_SSH_USERNAME }}@${{ vars.RC_SSH_HOST }} "curl -sf '${{ vars.RC_HEALTH_URL }}'" && echo " RC API healthy"