diff --git a/.gitea/workflows/deploy.yml b/.gitea/workflows/deploy.yml
index 2ba69ee..7ada11b 100644
--- a/.gitea/workflows/deploy.yml
+++ b/.gitea/workflows/deploy.yml
@@ -20,6 +20,7 @@ jobs:
       github.event.repository.default_branch == 'refs/heads/main'
       )
       )
+      )
       ) }}
     runs-on: ubuntu-latest
     env:
@@ -42,14 +43,36 @@ jobs:
           key: ${{ secrets.SSH_PRIVATE_KEY }}
           script: |
             IMAGE_SHA="${{ env.WORKFLOW_RUN_HEAD_SHA }}"
+            FALLBACK_BRANCH="${{ env.WORKFLOW_RUN_HEAD_BRANCH }}"
+            IMAGE_TAG="${IMAGE_SHA}"
             IMAGE_PATH="${{ env.REGISTRY_URL }}/${{ env.REGISTRY_ORG }}/${{ env.REGISTRY_IMAGE_NAME }}"
 
-            if [ -z "$IMAGE_SHA" ]; then
-              echo "Missing workflow run head SHA; aborting deployment." >&2
+            if [ -z "$FALLBACK_BRANCH" ]; then
+              FALLBACK_BRANCH="${{ env.WORKFLOW_RUN_REPO_DEFAULT_BRANCH }}"
+            fi
+
+            if [ -z "$FALLBACK_BRANCH" ]; then
+              FALLBACK_BRANCH="${{ env.REPOSITORY_DEFAULT_BRANCH }}"
+            fi
+
+            if [ -z "$IMAGE_TAG" ] && [ -n "$FALLBACK_BRANCH" ]; then
+              case "$FALLBACK_BRANCH" in
+                refs/heads/*)
+                  FALLBACK_BRANCH="${FALLBACK_BRANCH#refs/heads/}"
+                  ;;
+              esac
+
+              if [ "$FALLBACK_BRANCH" = "${DEFAULT_BRANCH:-main}" ]; then
+                IMAGE_TAG="latest"
+              fi
+            fi
+
+            if [ -z "$IMAGE_TAG" ]; then
+              echo "Missing workflow run head SHA and no default-branch fallback available; aborting deployment." >&2
               exit 1
             fi
 
-            docker pull "$IMAGE_PATH:$IMAGE_SHA"
+            docker pull "$IMAGE_PATH:$IMAGE_TAG"
             docker stop calminer || true
             docker rm calminer || true
             docker run -d --name calminer -p 8000:8000 \
@@ -60,7 +83,7 @@ jobs:
               -e DATABASE_PASSWORD=${{ secrets.DATABASE_PASSWORD }} \
               -e DATABASE_NAME=${{ secrets.DATABASE_NAME }} \
               -e DATABASE_SCHEMA=${{ secrets.DATABASE_SCHEMA }} \
-              "$IMAGE_PATH:$IMAGE_SHA"
+              "$IMAGE_PATH:$IMAGE_TAG"
 
             for attempt in {1..10}; do
               if curl -fsS http://localhost:8000/health >/dev/null; then