diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml
index da5f166..64fb398 100644
--- a/.github/workflows/main.yml
+++ b/.github/workflows/main.yml
@@ -528,19 +528,26 @@ jobs:
             gcloud compute scp "${source_file}" "${REMOTE_TARGET}:${dest_file}" "${SCP_FLAGS[@]}"
           }
 
+          SOURCE_ARCHIVE="$RUNNER_TEMP/ibkr-gateway-source.tar.gz"
+          REMOTE_ARCHIVE="/tmp/ibkr-gateway-${TARGET_NAME}-${GITHUB_SHA}.tar.gz"
+          git archive --format=tar.gz --output="${SOURCE_ARCHIVE}" HEAD
+          log_step "Uploading source archive to ${REMOTE_ARCHIVE}"
+          copy_remote_file "${SOURCE_ARCHIVE}" "${REMOTE_ARCHIVE}"
+
           REMOTE_SYNC_COMMAND=$(cat <<EOF
           set -euo pipefail
-          echo "[\$(date -u +%FT%TZ)] Syncing repository contents"
+          case '${DEPLOY_PATH}' in
+            ''|'/'|'/home'|'/opt')
+              echo "Refusing unsafe DEPLOY_PATH: '${DEPLOY_PATH}'" >&2
+              exit 1
+              ;;
+          esac
+          echo "[\$(date -u +%FT%TZ)] Syncing source archive"
+          sudo rm -rf '${DEPLOY_PATH}'
           sudo mkdir -p '${DEPLOY_PATH}'
           sudo chown -R '${GCE_USER}':'${GCE_USER}' '${DEPLOY_PATH}'
-          if [ -d '${DEPLOY_PATH}/.git' ]; then
-            cd '${DEPLOY_PATH}'
-            git fetch --all
-            git reset --hard origin/main
-          else
-            rm -rf '${DEPLOY_PATH}'
-            git clone 'https://github.com/${{ github.repository }}.git' '${DEPLOY_PATH}'
-          fi
+          tar -xzf '${REMOTE_ARCHIVE}' -C '${DEPLOY_PATH}'
+          rm -f '${REMOTE_ARCHIVE}'
           EOF
           )
 
diff --git a/README.md b/README.md
index 3603bbb..a312e49 100644
--- a/README.md
+++ b/README.md
@@ -164,6 +164,8 @@ sudo bash ./scripts/install_gateway_health_watcher.sh
 
 > Manual `workflow_dispatch` defaults to `keepalive`. If you really need to rebuild the image, choose `deploy_mode=full` when dispatching it.
 
+The deploy workflow uploads a source archive from the GitHub runner to the VM. The VM does not need GitHub credentials or a checked-out private repository to receive updates.
+
 ### Multiple Gateway Sessions on One VM
 
 The default deployment remains one container named `ib-gateway` exposing live/paper API ports `4001`/`4002`. To run another IBKR username on the same VM, use a separate deploy directory or `COMPOSE_PROJECT_NAME`, and give that instance unique container and host ports:
diff --git a/tests/test_workflow_shared_config.sh b/tests/test_workflow_shared_config.sh
index fdfecb5..a375f50 100644
--- a/tests/test_workflow_shared_config.sh
+++ b/tests/test_workflow_shared_config.sh
@@ -65,6 +65,8 @@ grep -Fq 'Scheduled keepalive mode: skip docker build' "$workflow_file"
 grep -Fq 'reset_instance_and_wait_for_ssh()' "$workflow_file"
 grep -Fq 'run_remote_ssh()' "$workflow_file"
 grep -Fq 'copy_remote_file()' "$workflow_file"
+grep -Fq 'git archive --format=tar.gz' "$workflow_file"
+grep -Fq 'tar -xzf' "$workflow_file"
 grep -Fq 'gcloud compute instances reset "${GCE_INSTANCE_NAME}"' "$workflow_file"
 grep -Fq 'run_remote_ssh "Repository sync" "${REMOTE_SYNC_COMMAND}"' "$workflow_file"
 grep -Fq 'copy_remote_file "${ENV_FILE}" "${DEPLOY_PATH}/.env"' "$workflow_file"