diff --git a/deploy/deploy.sh b/deploy/deploy.sh
index 5f4f341..5eab52d 100755
--- a/deploy/deploy.sh
+++ b/deploy/deploy.sh
@@ -2,10 +2,12 @@
 # Roll out the latest main branch to the public VPS instance.
 #
 # Layout on the host:
-#   /srv/siftlode/src    git clone of this repo (build context + compose file)
+#   /srv/siftlode/src    git clone of this repo (compose file + VERSION)
 #   /srv/siftlode/.env   secrets, mode 0600 (never in git)
 #
-# Build runs on the host Docker daemon, so it isn't constrained by the CI runner's memory.
+# The app is no longer built on the host — it's pulled as the prebuilt image published by
+# `siftlode publish`. We still sync the repo to pick up the new compose file + VERSION (which
+# selects the image tag to pull); the version/sha/build-date are baked into that image.
 set -euo pipefail
 
 ROOT=/srv/siftlode
@@ -15,11 +17,10 @@ git fetch --quiet origin
 git checkout --quiet main
 git pull --ff-only --quiet
 
-# Stamp the image with the version/commit being built (read by /api/version + the SPA).
-export APP_VERSION="$(cat VERSION 2>/dev/null || echo dev)"
-export GIT_SHA="$(git rev-parse --short HEAD)"
-export BUILD_DATE="$(date -u +%Y-%m-%dT%H:%M:%SZ)"
+# The released version selects the published image tag to pull.
+export APP_VERSION="$(cat VERSION 2>/dev/null || echo latest)"
 
-docker compose -f docker-compose.prod.yml --env-file "$ROOT/.env" up -d --build
+docker compose -f docker-compose.prod.yml --env-file "$ROOT/.env" pull
+docker compose -f docker-compose.prod.yml --env-file "$ROOT/.env" up -d
 docker image prune -f >/dev/null || true
 docker compose -f docker-compose.prod.yml --env-file "$ROOT/.env" ps
diff --git a/docker-compose.prod.yml b/docker-compose.prod.yml
index a258ac3..c6dd31e 100644
--- a/docker-compose.prod.yml
+++ b/docker-compose.prod.yml
@@ -34,14 +34,10 @@ services:
     restart: unless-stopped
 
   api:
-    build:
-      context: .
-      dockerfile: Dockerfile
-      args:
-        APP_VERSION: ${APP_VERSION:-dev}
-        GIT_SHA: ${GIT_SHA:-unknown}
-        BUILD_DATE: ${BUILD_DATE:-}
-    image: siftlode-api:local
+    # Prod pulls the prebuilt image published by `siftlode publish` instead of building on
+    # the host. The tag follows the released VERSION (deploy.sh exports APP_VERSION); the
+    # image already carries the baked-in version/sha/build-date stamps from the publish build.
+    image: forge.b1fr0st.eu/peter/siftlode:${APP_VERSION:-latest}
     env_file:
       - /srv/siftlode/.env
     environment: