diff --git a/.gitea/workflows/deploy.yaml b/.gitea/workflows/deploy.yaml
index 3c5ce36..6588a92 100644
--- a/.gitea/workflows/deploy.yaml
+++ b/.gitea/workflows/deploy.yaml
@@ -247,11 +247,18 @@ jobs:
               *) echo "refusing to open ${{ env.MINER_LINK_PORT }}/udp to non-mesh address '${miner_ip}' for ${m}" >&2; exit 1 ;;
             esac
             rich="rule family=ipv4 source address=${miner_ip}/32 service name=quantus-node-miner accept"
-            if run sudo firewall-cmd --zone="$zone" --query-rich-rule="$rich"; then
+            # Pass these as ONE pre-quoted string, not as separate run() args.
+            # `run()` is `ssh ... "$@"`, and ssh concatenates its argument vector
+            # with spaces for the REMOTE shell to re-split — so local quoting is
+            # lost and a rich rule arrives as a dozen bare words
+            # ("unrecognized arguments: family=ipv4 source address=..."). Every
+            # other command here survives only because no other argument
+            # contains a space. Keep the inner single quotes.
+            if run "sudo firewall-cmd --zone=$zone --query-rich-rule='$rich'"; then
               echo "firewalld: rich rule for ${m} already present in ${zone}"
             else
-              run sudo firewall-cmd --permanent --zone="$zone" --add-rich-rule="$rich"
-              run sudo firewall-cmd --zone="$zone" --add-rich-rule="$rich"
+              run "sudo firewall-cmd --permanent --zone=$zone --add-rich-rule='$rich'"
+              run "sudo firewall-cmd --zone=$zone --add-rich-rule='$rich'"
             fi
           done
 
diff --git a/CLAUDE.md b/CLAUDE.md
index 4e68f31..1af0a1c 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -52,6 +52,21 @@ without re-measuring:
 - Node Prometheus is on **9615**, not 9616. Upstream's `MINING.md` parameter
   table is wrong about this; the running binary is the authority.
 
+## ssh argument quoting
+
+`run()` in the deploy is `ssh ... "$@"`. ssh joins its argument vector with
+spaces and the REMOTE shell re-splits it, so any argument containing a space
+must be passed as one pre-quoted string:
+
+```sh
+run "sudo firewall-cmd --zone=$zone --add-rich-rule='$rich'"   # correct
+run sudo firewall-cmd --zone="$zone" --add-rich-rule="$rich"   # word-splits remotely
+```
+
+This bit the firewalld rich rules on run 1 and nothing else, because no other
+argument in the deploy contains a space. Check this before adding any command
+with a quoted multi-word argument.
+
 ## Working on the deploy
 
 - The workflow is the source of infra truth (`deployment-gitea-actions.md`).