diff --git a/.gitea/workflows/cd.yaml b/.gitea/workflows/cd.yaml
index 92e2e6dee..0310798b3 100644
--- a/.gitea/workflows/cd.yaml
+++ b/.gitea/workflows/cd.yaml
@@ -1311,7 +1311,8 @@ jobs:
           git remote remove origin 2>/dev/null || true
           git remote add origin "$GITEA_SOURCE_URL"
           git fetch --no-tags --prune --depth=1 origin "$GITHUB_SHA"
-          git checkout --force --detach FETCH_HEAD
+          # Deploy marker creation and push require a real local main ref.
+          git checkout --force -B main FETCH_HEAD
 
       - name: Wait for Host Web Build Pressure
         # 2026-06-27 Codex: post-deploy smoke is also browser-heavy. Refuse to
diff --git a/apps/api/tests/test_signal_worker_ansible_executor_binding.py b/apps/api/tests/test_signal_worker_ansible_executor_binding.py
index 415a53f07..274ba7b90 100644
--- a/apps/api/tests/test_signal_worker_ansible_executor_binding.py
+++ b/apps/api/tests/test_signal_worker_ansible_executor_binding.py
@@ -115,6 +115,7 @@ def test_cd_prunes_and_verifies_api_executor_boundary_in_production() -> None:
     assert "delete pods --all-namespaces" in workflow
     assert "repair-ssh-key|repair-known-hosts|ssh-mcp-key" in workflow
     assert "github.com/kubernetes-sigs/kustomize" not in workflow
+    assert "git checkout --force -B main FETCH_HEAD" in workflow
 
 
 def test_gitea_workflows_never_download_github_actions() -> None: