diff --git a/.forgejo/workflows/build.yml b/.forgejo/workflows/build.yml
index 0265948..3bdf16e 100644
--- a/.forgejo/workflows/build.yml
+++ b/.forgejo/workflows/build.yml
@@ -28,3 +28,17 @@ jobs:
           scp -i /tmp/deploy_key -o StrictHostKeyChecking=no hsa $TARGET:$REL/hsa
           ssh -i /tmp/deploy_key -o StrictHostKeyChecking=no $TARGET "chmod +x $REL/hsa"
           rm /tmp/deploy_key
+      - name: Activate release
+        if: startsWith(github.ref, 'refs/tags/')
+        run: |
+          TAG=${{ github.ref_name }}
+          if ! echo "$TAG" | grep -Eq '^[0-9]+\.[0-9]+\.[0-9]+$'; then
+            echo "Tag $TAG is a pre-release; staged but not activated."
+            exit 0
+          fi
+          echo "${{ secrets.FORGEJO_SSH }}" > /tmp/deploy_key
+          chmod 600 /tmp/deploy_key
+          TARGET=${{ vars.HSA_APP_USER }}@${{ vars.HSA_APP_HOST }}
+          ssh -i /tmp/deploy_key -o StrictHostKeyChecking=no $TARGET \
+            "cd hsa-app && ln -sfn releases/hsa-app-V$TAG/hsa hsa && systemctl --user restart hsa_app"
+          rm /tmp/deploy_key
diff --git a/.forgejo/workflows/deploy.yml b/.forgejo/workflows/deploy.yml
deleted file mode 100644
index 3921c4d..0000000
--- a/.forgejo/workflows/deploy.yml
+++ /dev/null
@@ -1,24 +0,0 @@
-name: Deploy
-on:
-  workflow_dispatch:
-    inputs:
-      tag:
-        description: 'Release version to activate, e.g. 0.0.0a1 (must already be staged in ~/hsa-app/releases/hsa-app-V<tag>/hsa)'
-        required: true
-jobs:
-  deploy:
-    runs-on: shell
-    steps:
-      - name: Activate release
-        run: |
-          echo "${{ secrets.FORGEJO_SSH }}" > /tmp/deploy_key
-          chmod 600 /tmp/deploy_key
-          TAG=${{ github.event.inputs.tag }}
-          TARGET=${{ vars.HSA_APP_USER }}@${{ vars.HSA_APP_HOST }}
-          ssh -i /tmp/deploy_key -o StrictHostKeyChecking=no $TARGET \
-            "cd hsa-app \
-             && test -f releases/hsa-app-V$TAG/hsa \
-             && chmod +x releases/hsa-app-V$TAG/hsa \
-             && ln -sfn releases/hsa-app-V$TAG/hsa hsa \
-             && systemctl --user restart hsa_app"
-          rm /tmp/deploy_key
diff --git a/deploy/INSTALL.md b/deploy/INSTALL.md
index 3478740..cf3dd2a 100644
--- a/deploy/INSTALL.md
+++ b/deploy/INSTALL.md
@@ -1,16 +1,17 @@
 # Deploying hsa-app
 
-The app runs as a **user systemd service** (no sudo). Deployment is two steps:
+The app runs as a **user systemd service** (no sudo). Deployment is driven by
+git tags:
 
-1. **Stage (automatic on tag)** — pushing a git tag builds + tests, then CI
-   copies the binary into `~/hsa-app/releases/hsa-app-V<tag>/hsa`. Nothing goes
-   live yet.
-2. **Activate (manual button)** — run the **Deploy** workflow from the Forgejo
-   Actions tab ("Run workflow"), entering the tag to activate. It points the
-   `~/hsa-app/hsa` symlink at that release and restarts the service.
+- **Release tags `X.Y.Z`** (e.g. `1.2.0`) — CI builds + tests, stages the binary
+  into `~/hsa-app/releases/hsa-app-V<tag>/hsa`, then **activates** it: points the
+  `~/hsa-app/hsa` symlink at that release and restarts the service.
+- **Pre-release tags** (anything else, e.g. `0.0.0a2`) — built, tested, and
+  staged into `releases/`, but **not** activated. Nothing goes live.
 
-The symlink decouples "what's on disk" from "what's running," so activation and
-rollback are just a symlink repoint + restart.
+The symlink decouples "what's on disk" from "what's running," so activating a
+staged pre-release or rolling back is just a symlink repoint + restart (see
+below).
 
 ## Layout on the host
 
@@ -73,9 +74,8 @@ journalctl --user -u hsa_app -f    # follow logs
 
 ## Deploy a tagged release
 
-Pushing a tag stages the binary automatically. To activate it, open the repo's
-**Actions → Deploy** workflow, click **Run workflow**, and enter the tag (e.g.
-`0.0.0a1`). To activate from the host instead:
+Push a release tag `X.Y.Z` — CI builds, stages, and activates it automatically.
+To manually activate a staged pre-release (or any release) from the host:
 
 ```bash
 cd ~/hsa-app