diff --git a/scripts/deploy.sh b/scripts/deploy.sh
index d1178b0..3489b45 100755
--- a/scripts/deploy.sh
+++ b/scripts/deploy.sh
@@ -99,7 +99,10 @@ fi
 
 # -------------------------------------------------------------- deploy ---
 
-SSH_CMD="ssh -i $SSH_KEY -o IdentitiesOnly=yes -o StrictHostKeyChecking=yes"
+# No StrictHostKeyChecking override: ssh falls back to its default (ask), so it
+# uses your personal ~/.ssh/known_hosts and prompts once on first connect. CI
+# pins it to yes instead, because it has no prompt and a known_hosts secret.
+SSH_CMD="ssh -i $SSH_KEY -o IdentitiesOnly=yes"
 TARGET="${DEPLOY_USER}@${DEPLOY_HOST}:${DEPLOY_PATH}/"
 RSYNC_OPTS=(-az --delete --checksum)