diff --git a/.gitea/workflows/deploy.yml b/.gitea/workflows/deploy.yml
index 7cf5dd4..b865299 100644
--- a/.gitea/workflows/deploy.yml
+++ b/.gitea/workflows/deploy.yml
@@ -133,7 +133,20 @@ jobs:
           # has confirmed the tag it names actually answered /health. A
           # fresh VM with no file yet falls back to :latest, same escape
           # hatch as a manual `up -d` with no TAG set.
-          PREV_TAG=$(cat /opt/drb/.last_good_tag 2>/dev/null || echo latest)
+          #
+          # server-26#156: `cat missing-file || echo latest` only falls back
+          # when cat itself fails (nonzero exit) -- a file that EXISTS but is
+          # EMPTY (the state this file was found in, 2026-09-20) makes cat
+          # succeed with empty output, so PREV_TAG became "" instead of
+          # "latest". That "" then failed the emptiness check below and
+          # exited 1 -- AFTER git pull + up -d had already succeeded -- which
+          # skips the Health check step entirely (later steps don't run after
+          # a failure), and Health check is the ONLY thing that ever writes a
+          # real value here. Self-perpetuating: every deploy failed the same
+          # way forever, with the app itself deploying fine underneath it.
+          # ${VAR:-default} covers empty AND unset in one expansion.
+          PREV_TAG=$(cat /opt/drb/.last_good_tag 2>/dev/null)
+          PREV_TAG="${PREV_TAG:-latest}"
           echo "PREV_TAG=$PREV_TAG"
 
           # Deploy THIS commit's images, not :latest. Overlapping runs are