diff --git a/.gitea/workflows/deploy.yml b/.gitea/workflows/deploy.yml
index e59f408..e186f80 100644
--- a/.gitea/workflows/deploy.yml
+++ b/.gitea/workflows/deploy.yml
@@ -112,20 +112,6 @@ jobs:
           set -e
           cd /opt/drb
 
-          # server-26#167: only main's tip deploys. Serialising (the job's
-          # concurrency group) stops two runs overlapping, but not an older
-          # run going AFTER a newer one (its build finished later, or someone
-          # re-ran it), which would silently roll prod back. A superseded run
-          # exits clean before touching anything; the newer run carries this
-          # commit's changes anyway. To deliberately put an older build back,
-          # use TAG=<sha> by hand on the VM, not a re-run.
-          git fetch -q origin main
-          MAIN_TIP=$(git rev-parse origin/main)
-          if [ "$MAIN_TIP" != "${{ gitea.sha }}" ]; then
-            echo "SUPERSEDED=$MAIN_TIP"
-            exit 0
-          fi
-
           # server-26#129: every deploy pushes 3 freshly SHA-tagged images and
           # nothing ever removed the old ones except a prune that only ran
           # AFTER a successful `compose pull` -- so a run that never got that
@@ -141,6 +127,22 @@ jobs:
           # block a deploy that doesn't actually need the space this time.
           docker image prune -af || echo "WARNING: pre-deploy image prune failed (server-26#129) -- disk pressure may persist"
 
+          # server-26#167: only main's tip deploys. Serialising (the job's
+          # concurrency group) stops two runs overlapping, but not an older
+          # run going AFTER a newer one (its build finished later, or someone
+          # re-ran it), which would silently roll prod back. A superseded run
+          # exits clean before pulling or restarting anything; the newer run carries this
+          # commit's changes anyway. To deliberately put an older build back,
+          # use TAG=<sha> by hand on the VM, not a re-run. Runs AFTER the
+          # server-26#129 prune above on purpose: on a full disk `git fetch` can
+          # fail too, and that prune must stay the first thing a deploy does.
+          git fetch -q origin main
+          MAIN_TIP=$(git rev-parse origin/main)
+          if [ "$MAIN_TIP" != "${{ gitea.sha }}" ]; then
+            echo "SUPERSEDED=$MAIN_TIP"
+            exit 0
+          fi
+
           # Update compose files + mosquitto config
           git pull origin main