diff --git a/.gitea/workflows/deploy.yaml b/.gitea/workflows/deploy.yaml
index 5d7b533..edf1af5 100644
--- a/.gitea/workflows/deploy.yaml
+++ b/.gitea/workflows/deploy.yaml
@@ -7,23 +7,13 @@ on:
 
 jobs:
   deploy:
-    runs-on: ubuntu-latest
+    runs-on: self-hosted
 
     steps:
-      - name: Deploy via SSH
-        env:
-          SSH_PRIVATE_KEY: ${{ secrets.DEPLOY_SSH_KEY }}
-          SERVER_IP: ${{ secrets.DEPLOY_SERVER_IP }}
-          SERVER_USER: ${{ secrets.DEPLOY_SERVER_USER }}
+      - name: Deploy
         run: |
-          mkdir -p ~/.ssh
-          echo "$SSH_PRIVATE_KEY" > ~/.ssh/id_rsa
-          chmod 600 ~/.ssh/id_rsa
-          ssh-keyscan -H $SERVER_IP >> ~/.ssh/known_hosts
-          ssh ${SERVER_USER}@${SERVER_IP} "
-            cd /data/projects/r/stAndrews &&
-            git pull origin main &&
-            docker compose build &&
-            docker compose up -d &&
-            docker exec analytics-gateway caddy reload --config /etc/caddy/Caddyfile --adapter caddyfile
-          "
+          cd /data/projects/r/stAndrews
+          git pull origin main
+          docker compose build
+          docker compose up -d
+          docker exec analytics-gateway caddy reload --config /etc/caddy/Caddyfile --adapter caddyfile
diff --git a/TODO.md b/TODO.md
index 3cbde5d..5730539 100644
--- a/TODO.md
+++ b/TODO.md
@@ -37,7 +37,7 @@
 
 ## Deployment
 
-- [ ] Fix SSH deploy workflow — failing since server outage; manual deploy required as workaround
+- [x] Fix SSH deploy workflow — switched to self-hosted runner (runs-on: self-hosted), eliminates SSH roundtrip
 - [x] Create Dockerfile, docker-compose.yml, .gitea/workflows/deploy.yaml
 - [x] Push to Gitea — act_runner deploys on push to main
 - [x] App live at apps.robwiederstein.org/stAndrews/