diff --git a/.woodpecker/deploy.yml b/.woodpecker/deploy.yml
index 9002f1c..731f409 100644
--- a/.woodpecker/deploy.yml
+++ b/.woodpecker/deploy.yml
@@ -1,5 +1,9 @@
 when:
-  - event: [manual, push]
+  # Manual-only — fired with IMAGE_TAG by the build pipeline (or
+  # by a human kicking off a deploy from the Woodpecker UI).
+  # The earlier `[manual, push]` would fire on every push and fail
+  # at check-vars because IMAGE_TAG is unset on push events.
+  - event: manual
 
 steps:
   - name: check-vars