diff --git a/README.md b/README.md
index 22d598e..715c620 100644
--- a/README.md
+++ b/README.md
@@ -181,7 +181,7 @@ One-time server bootstrap (secrets + registry login):
 ./scripts/setup-stage.sh
 ```
 
-`setup-stage.sh` clones `$HOME/andyTranscibe-stage`, writes a unique `.env`, creates `andytranscribe-stage-caddy`, and attaches Caddy Proxy Manager to that network. You still need DNS for `stage.transcribe.z00.nu` and `reverb.stage.transcribe.z00.nu`, plus Proxy Manager hosts:
+`setup-stage.sh` clones `$HOME/andyTranscibe-stage` from Gitea (not the prod checkout), writes a unique `.env`, creates `andytranscribe-stage-caddy`, and attaches Caddy Proxy Manager to that network. You still need DNS for `stage.transcribe.z00.nu` and `reverb.stage.transcribe.z00.nu`, plus Proxy Manager hosts:
 
 - `stage.transcribe.z00.nu` → `andytranscribe-stage-app:80`
 - `reverb.stage.transcribe.z00.nu` → `andytranscribe-stage-reverb:8080`
diff --git a/scripts/deploy-production.sh b/scripts/deploy-production.sh
index 16262f6..f6a65f0 100755
--- a/scripts/deploy-production.sh
+++ b/scripts/deploy-production.sh
@@ -44,7 +44,10 @@ for dir in "${DIRS[@]}"; do
 
         if git rev-parse --is-inside-work-tree >/dev/null 2>&1; then
             if [[ -n "${DEPLOY_SHA}" ]]; then
-                git fetch --force origin "${DEPLOY_SHA}"
+                git fetch --force origin '+refs/heads/*:refs/remotes/origin/*'
+                if ! git cat-file -e "${DEPLOY_SHA}^{commit}" 2>/dev/null; then
+                    git fetch --force origin "${DEPLOY_SHA}"
+                fi
                 git checkout --force --detach "${DEPLOY_SHA}"
                 git reset --hard "${DEPLOY_SHA}"
                 # Drop local edits/hot-patches; keep runtime data and secrets.
diff --git a/scripts/setup-stage.sh b/scripts/setup-stage.sh
index bcbfca2..20cbadd 100755
--- a/scripts/setup-stage.sh
+++ b/scripts/setup-stage.sh
@@ -8,8 +8,8 @@ GITEA_DIR="${GITEA_DIR:-${HOME}/gitea}"
 REPO_OWNER="${REPO_OWNER:-ben}"
 REPO_NAME="${REPO_NAME:-AndyTranscribe}"
 REGISTRY_HOST="${REGISTRY_HOST:-gitea.z00.nu}"
-PROD_PATH="${PROD_PATH:-${HOME}/andyTranscibe}"
 STAGE_PATH="${STAGE_PATH:-${HOME}/andyTranscibe-stage}"
+GITEA_REPO_URL="https://${REGISTRY_HOST}/${REPO_OWNER}/${REPO_NAME}.git"
 STAGE_URL="${STAGE_URL:-https://stage.transcribe.z00.nu}"
 REVERB_PUBLIC_HOST="${REVERB_PUBLIC_HOST:-reverb.stage.transcribe.z00.nu}"
 CONTAINER_PREFIX="${CONTAINER_PREFIX:-andytranscribe-stage}"
@@ -59,15 +59,13 @@ fi
 
 if [[ ! -d "${STAGE_PATH}/.git" ]]; then
     mkdir -p "$(dirname "${STAGE_PATH}")"
-    if [[ -d "${PROD_PATH}/.git" ]]; then
-        git clone "${PROD_PATH}" "${STAGE_PATH}"
-    else
-        git clone "https://${REGISTRY_HOST}/${REPO_OWNER}/${REPO_NAME}.git" "${STAGE_PATH}"
-    fi
+    git clone "${GITEA_REPO_URL}" "${STAGE_PATH}"
 fi
 
 (
     cd "${STAGE_PATH}"
+    # Never fetch from the prod checkout; CI deploys by SHA against this origin.
+    git remote set-url origin "${GITEA_REPO_URL}"
     git fetch origin || true
     if git rev-parse --verify origin/stage >/dev/null 2>&1; then
         git checkout stage
@@ -103,9 +101,10 @@ if [[ ! -f "${STAGE_PATH}/.env" ]]; then
     upsert_env "${STAGE_PATH}/.env" "APP_KEY" "base64:$(openssl rand -base64 32)"
     upsert_env "${STAGE_PATH}/.env" "APP_URL" "${STAGE_URL}"
     upsert_env "${STAGE_PATH}/.env" "PUBLIC_APP_URL" "${STAGE_URL}"
-    upsert_env "${STAGE_PATH}/.env" "APP_HOST_PORT" "18180"
-    upsert_env "${STAGE_PATH}/.env" "REVERB_HOST_PORT" "18181"
-    upsert_env "${STAGE_PATH}/.env" "WHISPER_HOST_PORT" "18190"
+    # Prod already binds 18080 (app), 18180 (reverb), and 18090 (whisper).
+    upsert_env "${STAGE_PATH}/.env" "APP_HOST_PORT" "18280"
+    upsert_env "${STAGE_PATH}/.env" "REVERB_HOST_PORT" "18281"
+    upsert_env "${STAGE_PATH}/.env" "WHISPER_HOST_PORT" "18290"
     upsert_env "${STAGE_PATH}/.env" "REVERB_APP_ID" "$(openssl rand -hex 8)"
     upsert_env "${STAGE_PATH}/.env" "REVERB_APP_KEY" "$(openssl rand -hex 16)"
     upsert_env "${STAGE_PATH}/.env" "REVERB_APP_SECRET" "$(openssl rand -hex 20)"
diff --git a/tests/Unit/SetupStageScriptTest.php b/tests/Unit/SetupStageScriptTest.php
new file mode 100644
index 0000000..42a06d0
--- /dev/null
+++ b/tests/Unit/SetupStageScriptTest.php
@@ -0,0 +1,29 @@
+<?php
+
+namespace Tests\Unit;
+
+use PHPUnit\Framework\TestCase;
+
+class SetupStageScriptTest extends TestCase
+{
+    public function test_clones_from_gitea_and_retargets_origin(): void
+    {
+        $script = file_get_contents(dirname(__DIR__, 2).'/scripts/setup-stage.sh');
+
+        $this->assertIsString($script);
+        $this->assertStringContainsString('git clone "${GITEA_REPO_URL}" "${STAGE_PATH}"', $script);
+        $this->assertStringContainsString('git remote set-url origin "${GITEA_REPO_URL}"', $script);
+        $this->assertStringNotContainsString('git clone "${PROD_PATH}"', $script);
+        $this->assertStringContainsString('APP_HOST_PORT" "18280"', $script);
+        $this->assertStringNotContainsString('APP_HOST_PORT" "18180"', $script);
+    }
+
+    public function test_deploy_fetches_advertised_refs_before_sha(): void
+    {
+        $script = file_get_contents(dirname(__DIR__, 2).'/scripts/deploy-production.sh');
+
+        $this->assertIsString($script);
+        $this->assertStringContainsString("git fetch --force origin '+refs/heads/*:refs/remotes/origin/*'", $script);
+        $this->assertStringContainsString('git checkout --force --detach "${DEPLOY_SHA}"', $script);
+    }
+}