diff --git a/.gitea/workflows/deploy.yaml b/.gitea/workflows/deploy.yaml
index bdebb37..469f195 100644
--- a/.gitea/workflows/deploy.yaml
+++ b/.gitea/workflows/deploy.yaml
@@ -188,11 +188,24 @@ jobs:
         run: |
           # Probe from the proxy, over the mesh — the path a user actually takes.
           # A loopback probe on bob would pass even if firewalld were closed.
-          ssh gitea_ci@"$WEB_HOST" \
+          # -n on every probe ssh: without it ssh reads stdin, and a future
+          # edit that pipes anything into this step would have the first ssh
+          # swallow the rest of the script.
+          ssh -n gitea_ci@"$WEB_HOST" \
             "curl -fsS http://$API_HOST:$API_PORT/v1/ready"
+          echo
+          # $unit unescaped: it must expand HERE, in the workflow's shell. The
+          # escaped form is a leftover from when this ran inside a heredoc, and
+          # over a plain ssh it sends a literal `$unit` for the remote shell to
+          # expand against nothing — `systemctl is-active .service`, exit 4.
           for unit in tireless-api tireless-poller; do
-            ssh gitea_ci@"$API_HOST" "systemctl is-active \$unit.service"
+            printf '%s: ' "$unit"
+            ssh -n gitea_ci@"$API_HOST" "systemctl is-active $unit.service"
           done
+          # tireless-runner is deliberately not probed: it refuses to start
+          # until the interactive agent login exists on the host, which is a
+          # manual step. Adding it here would make every deploy red for a
+          # reason the deploy cannot fix.
 
       - name: startup journal
         if: always()