diff --git a/.gitea/workflows/deploy-claude-dev-dev.yml b/.gitea/workflows/deploy-claude-dev-dev.yml
index 6756c50..36f56b7 100644
--- a/.gitea/workflows/deploy-claude-dev-dev.yml
+++ b/.gitea/workflows/deploy-claude-dev-dev.yml
@@ -11,6 +11,10 @@ on:
         description: 'Optional full image ref (for rollback), e.g. claude-dev:dev-abc123'
         required: false
 
+concurrency:
+  group: deploy-claude-dev-dev
+  cancel-in-progress: true
+
 jobs:
   deploy-claude-dev-dev:
     runs-on: ubuntu-latest
@@ -19,8 +23,13 @@ jobs:
         - /var/packages/ContainerManager/target/usr/bin/docker:/usr/bin/docker
         - /volume1/docker/claude-dev:/claude-dev-runtime
     steps:
-      - name: Checkout dev branch
-        run: git clone --depth 1 --branch dev http://gitea:3000/jimmy/nas-tools.git .
+      - name: Checkout exact commit
+        run: |
+          set -euo pipefail
+          git init .
+          git remote add origin http://gitea:3000/jimmy/nas-tools.git
+          git fetch --depth 1 origin "$GITHUB_SHA"
+          git checkout --detach FETCH_HEAD
 
       - name: Resolve image tags
         run: |
diff --git a/.gitea/workflows/deploy-dev.yml b/.gitea/workflows/deploy-dev.yml
index 49e83b7..50ed66f 100644
--- a/.gitea/workflows/deploy-dev.yml
+++ b/.gitea/workflows/deploy-dev.yml
@@ -4,7 +4,11 @@ on:
     branches: [dev]
     paths:
       - 'dashboard/**'
-      - '.gitea/workflows/**'
+      - '.gitea/workflows/deploy-dev.yml'
+
+concurrency:
+  group: deploy-dashboard-dev
+  cancel-in-progress: true
 
 jobs:
   deploy-dev:
@@ -14,8 +18,13 @@ jobs:
         - /var/packages/ContainerManager/target/usr/bin/docker:/usr/bin/docker
         - /volume1/docker/nas-dashboard:/nas-dashboard
     steps:
-      - name: Checkout dev branch
-        run: git clone --depth 1 --branch dev http://gitea:3000/jimmy/nas-tools.git .
+      - name: Checkout exact commit
+        run: |
+          set -euo pipefail
+          git init .
+          git remote add origin http://gitea:3000/jimmy/nas-tools.git
+          git fetch --depth 1 origin "$GITHUB_SHA"
+          git checkout --detach FETCH_HEAD
       - name: Build dev image
         run: DOCKER_BUILDKIT=0 docker build --cache-from nas-dashboard-dev:latest -t nas-dashboard-dev:latest dashboard/
       - name: Deploy dev
diff --git a/.gitea/workflows/deploy.yml b/.gitea/workflows/deploy.yml
index 1d5abd9..4f5906d 100644
--- a/.gitea/workflows/deploy.yml
+++ b/.gitea/workflows/deploy.yml
@@ -4,7 +4,11 @@ on:
     branches: [main]
     paths:
       - 'dashboard/**'
-      - '.gitea/workflows/**'
+      - '.gitea/workflows/deploy.yml'
+
+concurrency:
+  group: deploy-dashboard-main
+  cancel-in-progress: true
 
 jobs:
   deploy:
@@ -14,8 +18,13 @@ jobs:
         - /var/packages/ContainerManager/target/usr/bin/docker:/usr/bin/docker
         - /volume1/docker/nas-dashboard:/nas-dashboard
     steps:
-      - name: Checkout
-        run: git clone --depth 1 http://gitea:3000/jimmy/nas-tools.git .
+      - name: Checkout exact commit
+        run: |
+          set -euo pipefail
+          git init .
+          git remote add origin http://gitea:3000/jimmy/nas-tools.git
+          git fetch --depth 1 origin "$GITHUB_SHA"
+          git checkout --detach FETCH_HEAD
       - name: Build
         run: DOCKER_BUILDKIT=0 docker build -t nas-dashboard:latest dashboard/
       - name: Deploy