diff --git a/updater/src/index.js b/updater/src/index.js
index 742dc51..8fbaaaa 100644
--- a/updater/src/index.js
+++ b/updater/src/index.js
@@ -224,7 +224,21 @@ async function runRemote(target, repoName, cmd, label) {
 
 async function deploy(target, repoName) {
   const p = target.path
-  return runRemote(target, repoName, `git -C ${p} pull && docker compose -f ${p}/docker-compose.yml --project-directory ${p} up -d --build`, 'deploy')
+  const cloneUrl = FORGEJO_TOKEN
+    ? `${FORGEJO_URL.replace('://', `://oauth2:${FORGEJO_TOKEN}@`)}/${FORGEJO_ORG}/${repoName}.git`
+    : `${FORGEJO_URL}/${FORGEJO_ORG}/${repoName}.git`
+  const gitSsh = `GIT_SSH_COMMAND='ssh -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null'`
+  // If .git is missing (e.g. push_dir stripped it), re-clone via HTTPS preserving .env,
+  // then fall through to the normal pull + up.
+  const ensureGit =
+    `if [ ! -d ${p}/.git ]; then ` +
+    `[ -f ${p}/.env ] && cp ${p}/.env /tmp/_restore_${repoName}.env || true; ` +
+    `rm -rf ${p}; ` +
+    `${gitSsh} git clone ${cloneUrl} ${p}; ` +
+    `[ -f /tmp/_restore_${repoName}.env ] && mv /tmp/_restore_${repoName}.env ${p}/.env || true; ` +
+    `fi`
+  const cmd = `${ensureGit} && ${gitSsh} git -C ${p} pull && docker compose -f ${p}/docker-compose.yml --project-directory ${p} up -d --build`
+  return runRemote(target, repoName, cmd, 'deploy')
 }
 
 async function rebuild(target, repoName) {