diff --git a/.forgejo/workflows/backend-build-push.yml b/.forgejo/workflows/backend-build-push.yml
index b502978..514aaca 100644
--- a/.forgejo/workflows/backend-build-push.yml
+++ b/.forgejo/workflows/backend-build-push.yml
@@ -65,6 +65,12 @@ jobs:
       IMAGE_PATH: ${{ github.repository }}/backend
     steps:
       - uses: actions/checkout@v4
+        # fetch-depth 0: the tag is keyed to the LAST COMMIT THAT TOUCHED THIS
+        # DOMAIN, not the branch tip -- in a path-filtered monorepo the tip is
+        # often an unrelated domain's commit, and a depth-1 clone can't see
+        # past it to find the real key.
+        with:
+          fetch-depth: 0
 
       - name: Install Docker CLI
         run: |
@@ -77,7 +83,13 @@ jobs:
           host="${REGISTRY#https://}"; host="${host#http://}"
           path="$(printf '%s' "$IMAGE_PATH" | tr '[:upper:]' '[:lower:]')"
           ref="$host/$path"
-          sha_tag="$ref:sha-${GITHUB_SHA:0:12}"
+          # Key the tag to the last commit that touched backend/ -- the SAME key
+          # every backend deploy workflow computes -- so build and deploy always
+          # agree even when the branch tip is another domain's commit. (A tag
+          # keyed to the push tip breaks the moment an infra-only commit lands:
+          # deploys go looking for an image no build ever produced.)
+          domain_sha="$(git log -1 --format=%H -- backend/)"
+          sha_tag="$ref:sha-${domain_sha:0:12}"
           echo "host=$host" >> "$GITHUB_OUTPUT"
           echo "sha_tag=$sha_tag" >> "$GITHUB_OUTPUT"
           if [[ "$GITHUB_REF" == refs/tags/v* ]]; then
diff --git a/.forgejo/workflows/backend-deploy-dev.yml b/.forgejo/workflows/backend-deploy-dev.yml
index cee669a..88227f1 100644
--- a/.forgejo/workflows/backend-deploy-dev.yml
+++ b/.forgejo/workflows/backend-deploy-dev.yml
@@ -51,12 +51,20 @@ jobs:
       cancel-in-progress: false
     steps:
       - uses: actions/checkout@v4
+        # fetch-depth 0: the tag is keyed to the LAST COMMIT THAT TOUCHED THIS
+        # DOMAIN, not the branch tip -- in a path-filtered monorepo the tip is
+        # often an unrelated domain's commit, and a depth-1 clone can't see
+        # past it to find the real key.
+        with:
+          fetch-depth: 0
 
       - name: Compute image tag
         id: tag
-        # Same 12-hex truncation the beta/prod deploys use -- must match
-        # backend-build-push.yml's `sha-${GITHUB_SHA:0:12}` tag exactly.
-        run: echo "tag=sha-${GITHUB_SHA:0:12}" >> "$GITHUB_OUTPUT"
+        # Keyed to the last commit that touched backend/ -- must match
+        # backend-build-push.yml's tag key exactly (see its comment).
+        run: |
+          domain_sha="$(git log -1 --format=%H -- backend/)"
+          echo "tag=sha-${domain_sha:0:12}" >> "$GITHUB_OUTPUT"
 
       - name: Deploy to the LAN dev server
         # thermograph-lan is host-native (the runner job runs directly on the
diff --git a/.forgejo/workflows/backend-deploy.yml b/.forgejo/workflows/backend-deploy.yml
index d2cbbf7..0ad3999 100644
--- a/.forgejo/workflows/backend-deploy.yml
+++ b/.forgejo/workflows/backend-deploy.yml
@@ -35,9 +35,19 @@ jobs:
   deploy:
     runs-on: docker
     steps:
-      - name: Compute image tag
+      - uses: actions/checkout@v4
+        # fetch-depth 0: the tag is keyed to the LAST COMMIT THAT TOUCHED THIS
+        # DOMAIN, not the branch tip -- in a path-filtered monorepo the tip is
+        # often an unrelated domain's commit, and a depth-1 clone can't see
+        # past it to find the real key.
+        with:
+          fetch-depth: 0
+
+      - name: Compute image tag (last backend-touching commit)
         id: tag
-        run: echo "tag=sha-${GITHUB_SHA:0:12}" >> "$GITHUB_OUTPUT"
+        run: |
+          domain_sha="$(git log -1 --format=%H -- backend/)"
+          echo "tag=sha-${domain_sha:0:12}" >> "$GITHUB_OUTPUT"
 
       - name: Deploy backend over SSH
         uses: https://github.com/appleboy/ssh-action@v1.2.0
diff --git a/.forgejo/workflows/frontend-build-push.yml b/.forgejo/workflows/frontend-build-push.yml
index df6f568..cf38190 100644
--- a/.forgejo/workflows/frontend-build-push.yml
+++ b/.forgejo/workflows/frontend-build-push.yml
@@ -65,6 +65,12 @@ jobs:
       IMAGE_PATH: ${{ github.repository }}/frontend
     steps:
       - uses: actions/checkout@v4
+        # fetch-depth 0: the tag is keyed to the LAST COMMIT THAT TOUCHED THIS
+        # DOMAIN, not the branch tip -- in a path-filtered monorepo the tip is
+        # often an unrelated domain's commit, and a depth-1 clone can't see
+        # past it to find the real key.
+        with:
+          fetch-depth: 0
 
       - name: Install Docker CLI
         run: |
@@ -77,7 +83,13 @@ jobs:
           host="${REGISTRY#https://}"; host="${host#http://}"
           path="$(printf '%s' "$IMAGE_PATH" | tr '[:upper:]' '[:lower:]')"
           ref="$host/$path"
-          sha_tag="$ref:sha-${GITHUB_SHA:0:12}"
+          # Key the tag to the last commit that touched frontend/ -- the SAME key
+          # every frontend deploy workflow computes -- so build and deploy always
+          # agree even when the branch tip is another domain's commit. (A tag
+          # keyed to the push tip breaks the moment an infra-only commit lands:
+          # deploys go looking for an image no build ever produced.)
+          domain_sha="$(git log -1 --format=%H -- frontend/)"
+          sha_tag="$ref:sha-${domain_sha:0:12}"
           echo "host=$host" >> "$GITHUB_OUTPUT"
           echo "sha_tag=$sha_tag" >> "$GITHUB_OUTPUT"
           if [[ "$GITHUB_REF" == refs/tags/v* ]]; then
diff --git a/.forgejo/workflows/frontend-deploy-dev.yml b/.forgejo/workflows/frontend-deploy-dev.yml
index 2b745a8..0269777 100644
--- a/.forgejo/workflows/frontend-deploy-dev.yml
+++ b/.forgejo/workflows/frontend-deploy-dev.yml
@@ -51,12 +51,20 @@ jobs:
       cancel-in-progress: false
     steps:
       - uses: actions/checkout@v4
+        # fetch-depth 0: the tag is keyed to the LAST COMMIT THAT TOUCHED THIS
+        # DOMAIN, not the branch tip -- in a path-filtered monorepo the tip is
+        # often an unrelated domain's commit, and a depth-1 clone can't see
+        # past it to find the real key.
+        with:
+          fetch-depth: 0
 
       - name: Compute image tag
         id: tag
-        # Same 12-hex truncation the beta/prod deploys use -- must match
-        # frontend-build-push.yml's `sha-${GITHUB_SHA:0:12}` tag exactly.
-        run: echo "tag=sha-${GITHUB_SHA:0:12}" >> "$GITHUB_OUTPUT"
+        # Keyed to the last commit that touched frontend/ -- must match
+        # frontend-build-push.yml's tag key exactly (see its comment).
+        run: |
+          domain_sha="$(git log -1 --format=%H -- frontend/)"
+          echo "tag=sha-${domain_sha:0:12}" >> "$GITHUB_OUTPUT"
 
       - name: Deploy to the LAN dev server
         # thermograph-lan is host-native (the runner job runs directly on the