diff --git a/.woodpecker.yml b/.woodpecker.yml
index 9423a2e..564168a 100644
--- a/.woodpecker.yml
+++ b/.woodpecker.yml
@@ -109,6 +109,10 @@ steps:
         - -c
         - |
           set -euo pipefail
+          IMG_TAG="${1-}"
+          [ -n "$IMG_TAG" ] || { echo "❌ missing IMG_TAG arg"; exit 2; }
+          case "$IMG_TAG" in *" "*) echo "❌ IMG_TAG contains spaces: [$IMG_TAG]"; exit 2;; esac
+          export IMG_TAG
           [[ "${PROMOTE:-}" == "prod" ]] || { echo "⏭ Skipping (PROMOTE=$PROMOTE)"; exit 0; }
 
           mkdir -p ~/.ssh
@@ -123,7 +127,7 @@ steps:
 
           echo "🔑 SSH prerequisites installed"
           echo "🚀 Deploying tag $IMG_TAG to prod server $PROD_SSH_TARGET"
-          
+
           set -euo pipefail
           IMG_TAG="${1:?IMG_TAG arg missing}"
           export IMG_TAG
@@ -172,8 +176,8 @@ steps:
           ACCESS_COOKIE_NAME="$(gcloud secrets versions access latest --secret=ACCESS_COOKIE_NAME_$ENV --project="$PROJECT")"; export ACCESS_COOKIE_NAME
           export FROM_SECRETS_MANAGER=true
 
-          APP_DIR="/home/jcoakley_aptivaai_com"
-          cd "$APP_DIR"
+          cd /home/jcoakley_aptivaai_com || { echo "❌ /home/jcoakley_aptivaai_com missing"; exit 1; }
+          [ -f docker-compose.yml ] || { echo "❌ docker-compose.yml missing in $(pwd)"; exit 1; }
 
           # Make Artifact Registry creds available to root (docker compose runs under sudo)
           gcloud auth configure-docker us-central1-docker.pkg.dev -q