diff --git a/.gitea/workflows/deploy.yaml b/.gitea/workflows/deploy.yaml
index f716d13..947bc39 100644
--- a/.gitea/workflows/deploy.yaml
+++ b/.gitea/workflows/deploy.yaml
@@ -114,10 +114,14 @@ jobs:
           set -euo pipefail
           allowed=$(ssh "$EDGE_HOST" sudo -n -l 2>/dev/null || true)
           missing=0
+          # Destination-qualified, not just the command path. oolon is a SHARED
+          # proxy: blackbeard.observer and others already grant gitea_ci
+          # /usr/bin/rsync into *their* webroots, so a bare command check passes
+          # on somebody else's grant and the deploy then fails at the rsync.
           for cmd in \
-            "/usr/bin/rsync" \
-            "/usr/sbin/restorecon" \
-            "/usr/sbin/nginx" \
+            "/usr/bin/rsync * $WEBROOT/" \
+            "/usr/sbin/restorecon -R $WEBROOT" \
+            "/usr/sbin/nginx -t" \
             "/usr/bin/systemctl reload nginx"
           do
             if ! grep -qF -- "$cmd" <<<"$allowed"; then