diff --git a/.gitea/workflows/deploy.yml b/.gitea/workflows/deploy.yml
index e50fdca..4be6714 100644
--- a/.gitea/workflows/deploy.yml
+++ b/.gitea/workflows/deploy.yml
@@ -118,12 +118,20 @@ jobs:
           : "${SFTP_USER:?SFTP_USER secret must be set}"
           : "${SFTP_HOST:?SFTP_HOST secret must be set}"
           : "${SFTP_PATH:?SFTP_PATH secret must be set}"
+          # `-u USER,` (with trailing comma = empty password) tells lftp not
+          # to prompt for a password; auth happens via the key passed to ssh
+          # by sftp:connect-program. Heredoc body is unindented so lftp's
+          # parser doesn't mistake leading whitespace for a continuation.
+          # `debug 3` prints the ssh command lftp invokes — useful if this
+          # ever breaks again.
           lftp <<LFTP
-            set cmd:fail-exit yes
-            set sftp:connect-program 'ssh -a -x -i $HOME/.ssh/id_ed25519 -o StrictHostKeyChecking=yes -o UserKnownHostsFile=$HOME/.ssh/known_hosts'
-            open sftp://$SFTP_USER@$SFTP_HOST
-            mirror --reverse --delete --verbose --parallel=4 dist/ $SFTP_PATH/
-            bye
+          debug 3
+          set cmd:fail-exit yes
+          set net:max-retries 1
+          set sftp:connect-program 'ssh -a -x -i $HOME/.ssh/id_ed25519 -o StrictHostKeyChecking=yes -o UserKnownHostsFile=$HOME/.ssh/known_hosts'
+          open -u $SFTP_USER, sftp://$SFTP_HOST
+          mirror --reverse --delete --verbose --parallel=4 dist/ $SFTP_PATH/
+          bye
           LFTP
 
       - name: Post-deploy smoke test