diff --git a/scripts/deploy.sh b/scripts/deploy.sh
index 56e32a7..519e812 100755
--- a/scripts/deploy.sh
+++ b/scripts/deploy.sh
@@ -26,7 +26,30 @@
 
 set -euo pipefail
 
-cd "$(dirname "$0")/.."
+# Resolved BEFORE the re-exec below and carried across it. After the re-exec
+# `$0` is a copy in /tmp, so `dirname "$0"` would point at the wrong tree.
+PIG_REPO_ROOT="${PIG_REPO_ROOT:-$(cd "$(dirname "$0")/.." && pwd)}"
+export PIG_REPO_ROOT
+cd "$PIG_REPO_ROOT"
+
+# Run from a copy, because this script rewrites itself.
+#
+# `git reset --hard origin/main` below replaces this very file while bash is
+# still reading it. bash does not slurp a script: it reads incrementally and
+# remembers a byte OFFSET, so after the reset it resumes at that offset into
+# different content — which silently skips or splices steps, and at worst
+# executes a fragment of a line. The 13dec6b deploy hit exactly this: the new
+# public-origin gate was on disk and never ran, because bash was still
+# executing the buffered previous version.
+#
+# It failed harmlessly that time. It is not guaranteed to. scripts/autodeploy.sh
+# has always had this guard; deploy.sh needed it for the same reason.
+if [ "${PIG_DEPLOY_REEXEC:-}" != '1' ]; then
+  _copy=$(mktemp -t pig-deploy.XXXXXX)
+  cat "$0" > "$_copy"
+  PIG_DEPLOY_REEXEC=1 exec bash "$_copy" "$@"
+fi
+trap 'rm -f "$0"' EXIT
 
 # What compose will run. Must match the `image:` default in docker-compose.yml,
 # because that is the tag a rollback re-points at the previous image.