diff --git a/.woodpecker.yml b/.woodpecker.yml
index ea94c5e..927f66c 100644
--- a/.woodpecker.yml
+++ b/.woodpecker.yml
@@ -25,7 +25,8 @@ steps:
       # ── SSH into the staging VM and re‑create the stack ─────────
       ssh -o StrictHostKeyChecking=yes \
           -i ~/.ssh/id_ed25519 \
-          jcoakley@10.128.0.12 <<'EOF'
+          jcoakley@10.128.0.12 <<EOF
+        #!/usr/bin/env bash
         set -euo pipefail
         cd /opt/aptiva-staging-app
         echo "Pulling containers with IMG_TAG=${TAG}"
@@ -34,3 +35,10 @@ steps:
         IMG_TAG=${TAG} docker compose up -d --force-recreate --remove-orphans
         echo "✅  Staging stack refreshed"
       EOF
+
+environment:
+  - CI_COMMIT_SHA
+
+when:
+  event:
+    - push