diff --git a/.gitea/workflows/deploy-claude-dev-dev.yml b/.gitea/workflows/deploy-claude-dev-dev.yml
index 6756c50..b179de7 100644
--- a/.gitea/workflows/deploy-claude-dev-dev.yml
+++ b/.gitea/workflows/deploy-claude-dev-dev.yml
@@ -11,6 +11,10 @@ on:
         description: 'Optional full image ref (for rollback), e.g. claude-dev:dev-abc123'
         required: false
 
+concurrency:
+  group: deploy-claude-dev-dev
+  cancel-in-progress: true
+
 jobs:
   deploy-claude-dev-dev:
     runs-on: ubuntu-latest
@@ -19,8 +23,13 @@ jobs:
         - /var/packages/ContainerManager/target/usr/bin/docker:/usr/bin/docker
         - /volume1/docker/claude-dev:/claude-dev-runtime
     steps:
-      - name: Checkout dev branch
-        run: git clone --depth 1 --branch dev http://gitea:3000/jimmy/nas-tools.git .
+      - name: Checkout exact commit
+        run: |
+          set -euo pipefail
+          git init .
+          git remote add origin http://gitea:3000/jimmy/nas-tools.git
+          git fetch --depth 1 origin "$GITHUB_SHA"
+          git checkout --detach FETCH_HEAD
 
       - name: Resolve image tags
         run: |
@@ -80,6 +89,7 @@ jobs:
       - name: Record previous image
         run: |
           set -euo pipefail
+          mkdir -p /claude-dev-runtime
           previous_image="$(docker inspect -f '{{.Config.Image}}' claude-dev 2>/dev/null || true)"
           if [ -n "$previous_image" ]; then
             printf '%s\n' "$previous_image" > /claude-dev-runtime/previous-image.txt
@@ -94,6 +104,9 @@ jobs:
           cp claude-dev/docker-compose.yml /claude-dev-runtime/docker-compose.yml
           printf '%s\n' "$CLAUDE_DEV_IMAGE_TAG" > /claude-dev-runtime/target-tag.txt
 
+      - name: Remove stale claude-dev container
+        run: docker rm -f claude-dev || true
+
       - name: Deploy claude-dev
         run: |
           set -euo pipefail
diff --git a/.gitea/workflows/deploy-dev.yml b/.gitea/workflows/deploy-dev.yml
index 49e83b7..50ed66f 100644
--- a/.gitea/workflows/deploy-dev.yml
+++ b/.gitea/workflows/deploy-dev.yml
@@ -4,7 +4,11 @@ on:
     branches: [dev]
     paths:
       - 'dashboard/**'
-      - '.gitea/workflows/**'
+      - '.gitea/workflows/deploy-dev.yml'
+
+concurrency:
+  group: deploy-dashboard-dev
+  cancel-in-progress: true
 
 jobs:
   deploy-dev:
@@ -14,8 +18,13 @@ jobs:
         - /var/packages/ContainerManager/target/usr/bin/docker:/usr/bin/docker
         - /volume1/docker/nas-dashboard:/nas-dashboard
     steps:
-      - name: Checkout dev branch
-        run: git clone --depth 1 --branch dev http://gitea:3000/jimmy/nas-tools.git .
+      - name: Checkout exact commit
+        run: |
+          set -euo pipefail
+          git init .
+          git remote add origin http://gitea:3000/jimmy/nas-tools.git
+          git fetch --depth 1 origin "$GITHUB_SHA"
+          git checkout --detach FETCH_HEAD
       - name: Build dev image
         run: DOCKER_BUILDKIT=0 docker build --cache-from nas-dashboard-dev:latest -t nas-dashboard-dev:latest dashboard/
       - name: Deploy dev
diff --git a/.gitea/workflows/deploy.yml b/.gitea/workflows/deploy.yml
index 1d5abd9..4f5906d 100644
--- a/.gitea/workflows/deploy.yml
+++ b/.gitea/workflows/deploy.yml
@@ -4,7 +4,11 @@ on:
     branches: [main]
     paths:
       - 'dashboard/**'
-      - '.gitea/workflows/**'
+      - '.gitea/workflows/deploy.yml'
+
+concurrency:
+  group: deploy-dashboard-main
+  cancel-in-progress: true
 
 jobs:
   deploy:
@@ -14,8 +18,13 @@ jobs:
         - /var/packages/ContainerManager/target/usr/bin/docker:/usr/bin/docker
         - /volume1/docker/nas-dashboard:/nas-dashboard
     steps:
-      - name: Checkout
-        run: git clone --depth 1 http://gitea:3000/jimmy/nas-tools.git .
+      - name: Checkout exact commit
+        run: |
+          set -euo pipefail
+          git init .
+          git remote add origin http://gitea:3000/jimmy/nas-tools.git
+          git fetch --depth 1 origin "$GITHUB_SHA"
+          git checkout --detach FETCH_HEAD
       - name: Build
         run: DOCKER_BUILDKIT=0 docker build -t nas-dashboard:latest dashboard/
       - name: Deploy
diff --git a/claude-dev/Dockerfile b/claude-dev/Dockerfile
index d281067..5eeecab 100644
--- a/claude-dev/Dockerfile
+++ b/claude-dev/Dockerfile
@@ -1,4 +1,4 @@
-FROM node:20-bookworm
+FROM node:20-bookworm-slim
 
 ENV DEBIAN_FRONTEND=noninteractive