diff --git a/.woodpecker.yml b/.woodpecker.yml
index b427a16..ef48962 100644
--- a/.woodpecker.yml
+++ b/.woodpecker.yml
@@ -133,12 +133,12 @@ steps:
           --project=aptivaai-prod --zone=us-central1-a \
           --listen-on-stdin --verbosity=error" \
           -o StrictHostKeyChecking=accept-new -i ~/.ssh/id_ed25519 \
-          "$PROD_SSH_TARGET" \
+          "$PROD_SSH_TARGET" "$PROD_SSH_TARGET" bash -s -- "$IMG_TAG" \
           set -euo pipefail; \
+            IMG_TAG="${1:?IMG_TAG arg missing}"; export IMG_TAG
             PROJECT=aptivaai-prod; \
             export PROJECT; \
             ENV=prod; \
-            export IMG_TAG='"$IMG_TAG"'; \
             # sanity: ensure prod SM matches the single source (dev) before pull
             prod_val=$(gcloud secrets versions access latest --secret=IMG_TAG --project=$PROJECT); \
             [ "$prod_val" = "$IMG_TAG" ] || { echo "❌ Prod SM IMG_TAG ($prod_val) != dev IMG_TAG ($IMG_TAG)"; exit 1; }; \