diff --git a/.woodpecker.yml b/.woodpecker.yml
index 9689f89..f7912eb 100644
--- a/.woodpecker.yml
+++ b/.woodpecker.yml
@@ -176,8 +176,12 @@ steps:
           ACCESS_COOKIE_NAME="$(gcloud secrets versions access latest --secret=ACCESS_COOKIE_NAME_$ENV --project="$PROJECT")"; export ACCESS_COOKIE_NAME
           export FROM_SECRETS_MANAGER=true
 
-          cd /home/jcoakley_aptivaai_com
-          [ -f docker-compose.yml ]
+          APP_DIR="/home/jcoakley_aptivaai_com"
+          cd "$APP_DIR"
+          echo "🔖 VM sees IMG_TAG: [$IMG_TAG]"
+          echo "🔖 root will see:"; sudo env | grep '^IMG_TAG=' || echo "   (none)"
+          
+          [ -f docker-compose.yml ] || { echo "❌ docker-compose.yml missing in $PWD"; exit 1; }
 
           # Make Artifact Registry creds available to root (docker compose runs under sudo)
           gcloud auth configure-docker us-central1-docker.pkg.dev -q