diff --git a/scripts/deploy.sh b/scripts/deploy.sh
index c0b9d45..f5fbb52 100755
--- a/scripts/deploy.sh
+++ b/scripts/deploy.sh
@@ -10,14 +10,13 @@ source "$ROOT_DIR/scripts/config.sh"
 
 git push origin main
 
-# SSH to target and update
-ssh "$HOST" "cd $DEST && git pull origin main && bun run build"
+# SSH to target: pull, build, sync apps, restart
+ssh "$HOST" DEST="$DEST" APPS_DIR="$APPS_DIR" bash <<'SCRIPT'
+set -e
+
+cd "$DEST" && git pull origin main && bun run build
 
-# Sync default apps/tools from repo to APPS_DIR
 echo "=> Syncing default apps..."
-ssh "$HOST" bash -s "$DEST" "$APPS_DIR" <<'SCRIPT'
-DEST="$1"
-APPS_DIR="$2"
 for app_dir in "$DEST"/apps/*/; do
   app=$(basename "$app_dir")
   for version_dir in "$app_dir"*/; do
@@ -32,9 +31,9 @@ for app_dir in "$DEST"/apps/*/; do
     (cd "$target" && bun install --frozen-lockfile 2>/dev/null || bun install)
   done
 done
-SCRIPT
 
-ssh "$HOST" "sudo systemctl restart toes.service"
+sudo systemctl restart toes.service
+SCRIPT
 
 echo "=> Deployed to $HOST"
 echo "=> Visit $URL"