diff --git a/deploy/deploy.sh b/deploy/deploy.sh
index 574485e..6580ec3 100755
--- a/deploy/deploy.sh
+++ b/deploy/deploy.sh
@@ -141,8 +141,18 @@ case "$SERVICE" in
   all) TARGETS=(backend frontend) ;;
 esac
 
-echo "==> Logging in to the registry ($REGISTRY_HOST)"
-echo "$REGISTRY_TOKEN" | docker login "$REGISTRY_HOST" --username emi --password-stdin
+# Login only when a token is supplied. The SSH/CI deploy paths (deploy.yml,
+# deploy-prod.yml, deploy-dev on the LAN runner) don't pass REGISTRY_TOKEN --
+# the host is already `docker login`ed to the registry (persistent cred in
+# ~/.docker/config.json), so an unconditional login with an empty token would
+# abort the deploy under `set -e`. Use the token if present, else trust the
+# host's existing cred; a genuine auth problem then fails loudly at `pull`.
+if [ -n "${REGISTRY_TOKEN:-}" ]; then
+  echo "==> Logging in to the registry ($REGISTRY_HOST)"
+  echo "$REGISTRY_TOKEN" | docker login "$REGISTRY_HOST" --username emi --password-stdin
+else
+  echo "==> No REGISTRY_TOKEN in env; relying on the host's existing docker login to $REGISTRY_HOST"
+fi
 
 echo "==> Pulling images (backend=$BACKEND_IMAGE_TAG frontend=$FRONTEND_IMAGE_TAG; rolling: ${TARGETS[*]})"
 # Retry: build-push.yml (triggered by the same push) has no ordering guarantee