diff --git a/scripts/ha/deploy.sh b/scripts/ha/deploy.sh
index acdecac..b47c079 100755
--- a/scripts/ha/deploy.sh
+++ b/scripts/ha/deploy.sh
@@ -236,16 +236,32 @@ if ! $SKIP_SYNC_KEYS; then
   done
 fi
 
-# ── Phase 2.5: Fix /nix ownership on Proxmox node if needed ──────────────────
-# pve1 has a pre-existing /nix store owned by a different UID (from a previous
-# installation); wayne has passwordless sudo so we fix it in-place before the
-# build so create-proxmox-resource.sh's codex-setup.sh can proceed.
+# ── Phase 2.5: Prepare Proxmox node for building ─────────────────────────────
 if ! $SKIP_CREATE_VMS && ! $DRY_RUN; then
+  CURRENT_BRANCH="$(git -C "$REPO_ROOT" rev-parse --abbrev-ref HEAD)"
+
+  # Fix /nix ownership if it exists but belongs to a different UID.
+  # pve1's IPA-enrolled wayne (UID 50002) can't write to a store created by
+  # another UID — passwordless sudo corrects it once.
   if pve_check "test -d /nix" &>/dev/null && ! pve_check "test -w /nix" &>/dev/null; then
     logn "/nix exists but not writable by ${SSH_USER} — fixing ownership with sudo (one-time)..."
     ssh -i ~/.ssh/id_ed25519 "${SSH_USER}@${NODE}" "sudo chown -R ${SSH_USER} /nix"
     logn "Done."
   fi
+
+  # Ensure the remote clone is on the correct branch so create-proxmox-resource.sh
+  # builds from the same commits we're deploying.
+  REMOTE_REPO="/home/${SSH_USER}/nixos"
+  if pve_check "test -d ${REMOTE_REPO}/.git" &>/dev/null; then
+    REMOTE_BRANCH=$(ssh -i ~/.ssh/id_ed25519 "${SSH_USER}@${NODE}" \
+      "cd ${REMOTE_REPO} && git rev-parse --abbrev-ref HEAD 2>/dev/null")
+    if [[ "$REMOTE_BRANCH" != "$CURRENT_BRANCH" ]]; then
+      logn "Remote clone is on '${REMOTE_BRANCH}', switching to '${CURRENT_BRANCH}'..."
+      ssh -i ~/.ssh/id_ed25519 "${SSH_USER}@${NODE}" \
+        "cd ${REMOTE_REPO} && git fetch origin && git checkout '${CURRENT_BRANCH}' && git pull --ff-only"
+      logn "Done."
+    fi
+  fi
 fi
 
 # ── Phase 3: Create VMs ───────────────────────────────────────────────────────