diff --git a/.gitea/workflows/deploy-scp.yaml b/.gitea/workflows/deploy-scp.yaml
index 13035c1..667c721 100644
--- a/.gitea/workflows/deploy-scp.yaml
+++ b/.gitea/workflows/deploy-scp.yaml
@@ -42,21 +42,6 @@ jobs:
   deploy:
     runs-on: ubuntu-latest
     steps:
-      # TEMPORARY — diagnosing a persistent "Permission denied, please try again." (sshpass exit 5)
-      # on the SSH steps below. Never prints the actual secret values, only lengths and a boolean
-      # match against the expected username, so it's safe to leave in a log — but remove this step
-      # once the PI_MAIN_* secrets are confirmed correct; it has no purpose beyond that diagnosis.
-      - name: Debug - verify PI_MAIN_USERNAME/PASSWORD secrets (remove after diagnosis)
-        run: |
-          echo "PI_MAIN_USERNAME length: ${#PI_MAIN_USERNAME}"
-          echo "PI_MAIN_USERNAME equals 'gitea-workflow': $([ "$PI_MAIN_USERNAME" = "gitea-workflow" ] && echo yes || echo no)"
-          echo "PI_MAIN_PASSWORD length: ${#PI_MAIN_PASSWORD}"
-          PW_TRIMMED="$(printf '%s' "$PI_MAIN_PASSWORD" | sed -e 's/^[[:space:]]*//' -e 's/[[:space:]]*$//')"
-          echo "PI_MAIN_PASSWORD trimmed length: ${#PW_TRIMMED}"
-        env:
-          PI_MAIN_USERNAME: ${{ secrets.PI_MAIN_USERNAME }}
-          PI_MAIN_PASSWORD: ${{ secrets.PI_MAIN_PASSWORD }}
-
       - name: Compute release timestamp
         id: release
         run: echo "timestamp=$(date -u +%Y%m%d%H%M%S)" >> "$GITHUB_OUTPUT"
@@ -126,7 +111,10 @@ jobs:
       # first-ever deploy, before any website workspace has published anything there (U1 already
       # tolerates a missing wwwroot/web at startup). The publish output's own wwwroot/web (empty, or
       # containing only the placeholder page) is removed before the symlink is created, so it never
-      # shadows the persistent content.
+      # shadows the persistent content. `mkdir -p $RELEASE_DIR/wwwroot` guards against `ln -s` failing
+      # with "No such file or directory": dotnet publish only emits a wwwroot/ folder at all when the
+      # source project has one with actual content, so a release built before any frontend content
+      # exists can land with no wwwroot/ directory whatsoever, not merely an empty wwwroot/web/.
       - name: Link persistent website content
         env:
           SSH_USER: ${{ secrets.PI_MAIN_USERNAME }}
@@ -140,6 +128,7 @@ jobs:
             -o StrictHostKeyChecking=no \
             "$SSH_USER@$SSH_HOST" \
             "mkdir -p ${{ inputs.deploy_path }}/shared/wwwroot-web && \
+             mkdir -p $RELEASE_DIR/wwwroot && \
              rm -rf $RELEASE_DIR/wwwroot/web && \
              ln -s ../../../shared/wwwroot-web $RELEASE_DIR/wwwroot/web"