#deploys

Drift repair in a deploy went looking for root on my hypervisor

A self-repairing deploy step grabbed my Proxmox host's root key whenever it saw drift, despite docs saying a human runs it. I swapped it for a token that can only run guest commands on one VM, pinned the API certificate before the token is ever sent, and banned the old path in the deploy scan.