diff --git a/.gitea/workflows/deploy.yml b/.gitea/workflows/deploy.yml
index 7cd3f7b..e3275f4 100644
--- a/.gitea/workflows/deploy.yml
+++ b/.gitea/workflows/deploy.yml
@@ -149,5 +149,12 @@ jobs:
           export MANGALORD_TAG="$IMAGE_TAG"
           docker compose pull mangalord-backend mangalord-frontend
           docker compose up -d mangalord-backend mangalord-frontend
+          # Persist the deployed SHA into .env so it reflects what's actually
+          # live. The export above is shell-only; without this, .env keeps its
+          # `latest` placeholder and `docker inspect` is the only way to see the
+          # running SHA. Runs only after a successful `up -d` (set -eu); kept
+          # non-fatal so a write hiccup can't fail an otherwise-good deploy.
+          sed -i "s/^MANGALORD_TAG=.*/MANGALORD_TAG=${IMAGE_TAG}/" .env \
+            || echo "::warning::could not persist MANGALORD_TAG to .env"
           docker image prune -f
           docker logout "$REGISTRY_URL"