diff --git a/.gitea/workflows/cd.yml b/.gitea/workflows/cd.yml
index 1bf9c3c..a56696c 100644
--- a/.gitea/workflows/cd.yml
+++ b/.gitea/workflows/cd.yml
@@ -81,11 +81,19 @@ jobs:
           git config user.email "cd-bot@d-ma.be"
           git config user.name "CD Bot"
           git add "k3s/apps/supervisor/ingestion-deployment.yaml"
-          git commit -m "chore(deploy): ingestion → ${IMAGE_TAG}"
-          GIT_SSH_COMMAND="ssh -i ~/.ssh/infra_deploy_key -o IdentitiesOnly=yes" \
-            git push
-
-          echo "Infra repo updated: ingestion → ${IMAGE_TAG}"
+          # Idempotent: `git commit` exits 1 on an empty index, so a run that
+          # finds the bump already applied failed the whole job and rang the
+          # CI-red alarm for a deploy that was fine (hyperguild#118). Two
+          # sources of a no-op run: a manual re-run, and the tag-push CI run
+          # that used to shadow the branch-push one for the same sha.
+          if git diff --cached --quiet; then
+            echo "Infra already at ${IMAGE_TAG} — nothing to commit"
+          else
+            git commit -m "chore(deploy): ingestion → ${IMAGE_TAG}"
+            GIT_SSH_COMMAND="ssh -i ~/.ssh/infra_deploy_key -o IdentitiesOnly=yes" \
+              git push
+            echo "Infra repo updated: ingestion → ${IMAGE_TAG}"
+          fi
 
       - name: Trigger Flux reconcile (immediate)
         run: |
diff --git a/.gitea/workflows/ci.yml b/.gitea/workflows/ci.yml
index 4011a8d..f0de45f 100644
--- a/.gitea/workflows/ci.yml
+++ b/.gitea/workflows/ci.yml
@@ -2,8 +2,13 @@ name: CI
 
 "on":
   push:
+    # Branch only. A `v*` tag here points at a commit main already tested, so
+    # the tag push re-ran the whole gate and — because cd.yml keys off "CI
+    # succeeded" — triggered a SECOND full image build and deploy for the same
+    # sha. That second deploy then died on "nothing to commit" (hyperguild#118).
+    # Nothing consumes a tag-triggered run: there is no release workflow, and
+    # cd.yml reads github.sha, not the tag.
     branches: [main]
-    tags: ["v*"]
   pull_request:
     branches: [main]