diff --git a/.woodpecker.yml b/.woodpecker.yml
index 8a1c9ba..7c61ce5 100644
--- a/.woodpecker.yml
+++ b/.woodpecker.yml
@@ -9,7 +9,7 @@ steps:
 
         mkdir -p ~/.ssh
 
-        # ── Inject known-hosts and SSH key from Secret Manager ─────
+        # ── Inject known-hosts and SSH key ──────────────────────────────
         gcloud secrets versions access latest \
           --secret=STAGING_KNOWN_HOSTS --project=aptivaai-dev \
           | base64 -d > ~/.ssh/known_hosts
@@ -22,16 +22,17 @@ steps:
 
         echo "🔑 SSH prerequisites installed"
 
-        # ── Tag slicing from CI_COMMIT_SHA only ────────────────────
-        TAG=$(echo "${CI_COMMIT_SHA}" | head -c 8)
+        # ── Grab full commit SHA and slice tag ──────────────────────────
+        echo "📦 CI_COMMIT_SHA: ${CI_COMMIT_SHA:-unset}"
+        TAG="${CI_COMMIT_SHA:-}"
         if [ -z "$TAG" ]; then
-          echo "❌ CI_COMMIT_SHA is missing or blank"
+          echo "❌ CI_COMMIT_SHA is blank. Aborting."
           exit 1
         fi
-
+        TAG=$(echo "$TAG" | head -c 8)
         echo "🚀 Deploying tag ${TAG} to staging"
 
-        # ── SSH into staging and refresh the Docker stack ──────────
+        # ── SSH into staging and refresh the stack ──────────────────────
         ssh -o StrictHostKeyChecking=yes \
             -i ~/.ssh/id_ed25519 \
             jcoakley@10.128.0.12 \