diff --git a/.mokogitea/workflows/custom/deploy-dev.yml b/.mokogitea/workflows/custom/deploy-dev.yml
index 84159835f7..106c882eb0 100644
--- a/.mokogitea/workflows/custom/deploy-dev.yml
+++ b/.mokogitea/workflows/custom/deploy-dev.yml
@@ -52,51 +52,61 @@ jobs:
           REGISTRY_TOKEN: ${{ secrets.MOKOGITEA_TOKEN }}
           TAG: ${{ steps.config.outputs.tag }}
         run: |
-          HEALTH_FMT='${{ '{{' }}.State.Health.Status${{ '}}' }}'
-
+          # Inject runner-side values (TAG, REGISTRY_TOKEN) into the remote shell's
+          # environment via a command prefix, then use a *quoted* heredoc so every
+          # $var below expands in exactly one place: the remote dev host. This avoids
+          # the local-vs-remote expansion trap that previously left TAG empty.
           ssh -i ~/.ssh/deploy_key -p ${{ env.DEPLOY_PORT }} \
             -o ConnectTimeout=30 -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null \
             -o ServerAliveInterval=30 -o ServerAliveCountMax=10 \
-            ${{ env.DEPLOY_USER }}@${{ env.DEPLOY_HOST }} bash -s <<DEPLOY_EOF
+            ${{ env.DEPLOY_USER }}@${{ env.DEPLOY_HOST }} \
+            "TAG='$TAG' REGISTRY_TOKEN='$REGISTRY_TOKEN' bash -s" <<'DEPLOY_EOF'
           set -e
           echo 'SSH connected to dev environment'
 
+          if [ -z "$TAG" ]; then
+            echo 'ERROR: TAG is empty; refusing to build an untagged image' >&2
+            exit 1
+          fi
+
+          HEALTH_FMT='{{.State.Health.Status}}'
+
           echo 'Cleaning Docker build cache...'
           docker builder prune -af 2>/dev/null || true
           docker image prune -af 2>/dev/null || true
 
           echo 'Pulling source...'
           SOURCE_DIR=/opt/gitea-dev/source
-          if [ ! -d \$SOURCE_DIR/.git ]; then
-            git clone -b dev https://git.mokoconsulting.tech/MokoConsulting/MokoGitea-Fork.git \$SOURCE_DIR
+          if [ ! -d "$SOURCE_DIR/.git" ]; then
+            git clone -b dev https://git.mokoconsulting.tech/MokoConsulting/MokoGitea-Fork.git "$SOURCE_DIR"
           fi
-          cd \$SOURCE_DIR
+          cd "$SOURCE_DIR"
           git remote set-url origin https://git.mokoconsulting.tech/MokoConsulting/MokoGitea-Fork.git 2>/dev/null || true
           git fetch origin dev
           git reset --hard origin/dev
 
-          echo 'Building Docker image...'
+          echo "Building Docker image: ${{ env.REGISTRY }}/${{ env.IMAGE }}:$TAG"
           docker build --no-cache --build-arg GOFLAGS='-p 1' \
-            --tag ${{ env.REGISTRY }}/${{ env.IMAGE }}:\$TAG \
+            --tag "${{ env.REGISTRY }}/${{ env.IMAGE }}:$TAG" \
             -f Dockerfile .
 
           echo 'Pushing to registry...'
-          echo '\$REGISTRY_TOKEN' | docker login ${{ env.REGISTRY }} -u ${{ env.DEPLOY_USER }} --password-stdin
-          docker push ${{ env.REGISTRY }}/${{ env.IMAGE }}:\$TAG
+          echo "$REGISTRY_TOKEN" | docker login ${{ env.REGISTRY }} -u ${{ env.DEPLOY_USER }} --password-stdin
+          docker push "${{ env.REGISTRY }}/${{ env.IMAGE }}:$TAG"
 
           echo 'Restarting dev container...'
           cd /opt/gitea-dev
-          sed -i "s|${{ env.IMAGE }}:[^ ]*|${{ env.IMAGE }}:\$TAG|" docker-compose.yml
+          sed -i "s|${{ env.IMAGE }}:[^ ]*|${{ env.IMAGE }}:$TAG|" docker-compose.yml
           docker compose up -d mokogitea-dev
 
           echo 'Health check...'
           for i in 1 2 3 4 5 6 7 8; do
             sleep 15
-            if docker inspect --format='\$HEALTH_FMT' mokogitea-dev 2>/dev/null | grep -q healthy; then
+            if docker inspect --format="$HEALTH_FMT" mokogitea-dev 2>/dev/null | grep -q healthy; then
               echo 'Dev container healthy!'
               exit 0
             fi
-            echo "Waiting... (attempt \$i/8)"
+            echo "Waiting... (attempt $i/8)"
           done
           echo 'Health check failed'
           docker logs mokogitea-dev --tail 20