diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index ff55942..a7ec459 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -33,7 +33,7 @@ jobs:
         working-directory: apps/web
         run: bun run build
 
-      # Upload the built .next directory (hidden dir, so include-hidden-files).
+      # Upload the built .next directory (hidden dir → include-hidden-files).
       # The deploy job downloads this and copies to the VPS — no build on VPS.
       - name: Upload web build artifact
         uses: actions/upload-artifact@v4
@@ -43,8 +43,7 @@ jobs:
           include-hidden-files: true
           if-no-files-found: error
 
-      # Smoke: verify the MCP server + resources load and the indexer/module
-      # graph resolves. Requires Postgres + Redis — only runs when available.
+      # Smoke: requires Postgres + Redis — skipped in CI without secrets.
       - name: MCP smoke test
         if: env.DATABASE_URL != ''
         working-directory: apps/mcp
@@ -53,9 +52,7 @@ jobs:
           REDIS_URL: ${{ secrets.REDIS_URL }}
         run: bun run smoke
 
-      # Unit tests across all packages + apps. CI has no Postgres/Redis, so
-      # tests use bun:test module mocking to stub @mcpedia/db, @mcpedia/queue,
-      # and @mcpedia/embeddings — no live I/O.
+      # Unit tests — bun:test mocks, no external services.
       - name: Test
         run: bun run test
 
@@ -74,15 +71,21 @@ jobs:
           name: mcpedia-web-build
           path: apps/web
 
-      - name: Copy pre-built .next to VPS
+      # Tar .next on the runner (handles hidden files correctly),
+      # then SCP the tarball to VPS and SSH to unpack + restart.
+      # VPS only receives + unpacks — no build step on the VPS.
+      - name: Create deploy tarball
+        run: tar -C apps/web -czf mcpedia-web-next.tar.gz .next
+
+      - name: Copy tarball to VPS
         uses: appleboy/scp-action@v1
         with:
           host: ${{ secrets.SSH_DEPLOY_HOST }}
           port: ${{ secrets.SSH_DEPLOY_PORT }}
           username: ${{ secrets.SSH_DEPLOY_USER }}
           key: ${{ secrets.SSH_DEPLOY_KEY }}
-          source: "apps/web/.next/*"
-          target: "/home/code/mcpedia/apps/web/.next"
+          source: "mcpedia-web-next.tar.gz"
+          target: "/tmp/mcpedia-web-next.tar.gz"
 
       - name: Deploy to VPS over SSH
         uses: appleboy/ssh-action@v1
@@ -101,7 +104,12 @@ jobs:
             /home/code/.bun/bin/bun install --frozen-lockfile
             /home/code/.bun/bin/bun run scripts/indexer.ts
 
-            # .next/ was just copied from CI (pre-built, no build on VPS)
+            # Unpack the pre-built .next (built in CI — no build on VPS)
+            rm -rf apps/web/.next
+            tar -xzf /tmp/mcpedia-web-next.tar.gz -C apps/web/
+            rm -f /tmp/mcpedia-web-next.tar.gz
+
+            # Restart services to pick up the new build
             sudo systemctl restart mcpedia-web mcpedia-api mcpedia-mcp mcpedia-worker
             sleep 3
             systemctl --no-pager status mcpedia-web mcpedia-api mcpedia-mcp mcpedia-worker --no-legend