diff --git a/playbooks/deploy-task-board.yaml b/playbooks/deploy-task-board.yaml
index ea9c624..efd2f84 100644
--- a/playbooks/deploy-task-board.yaml
+++ b/playbooks/deploy-task-board.yaml
@@ -50,11 +50,20 @@ steps:
   - name: Fetch from origin
     shell: cd {{ build_dir }} && git fetch --quiet origin
 
-  - name: Reset working tree to origin/{{ ref }}
-    shell: cd {{ build_dir }} && git reset --hard origin/{{ ref }}
+  - name: Reset working tree to {{ ref }}
+    # Accept either a branch name (resolves via origin/<ref>) or a
+    # full/short SHA (resolves directly). CI passes the triggering
+    # commit SHA via --var ref=${{ github.sha }}; manual runs pass
+    # branch names like main / v0.1.0.
+    shell: |
+      cd {{ build_dir }}
+      if sha=$(git rev-parse --verify --quiet "origin/{{ ref }}^{commit}"); then :;
+      elif sha=$(git rev-parse --verify --quiet "{{ ref }}^{commit}"); then :;
+      else echo "elway: ref not found: {{ ref }}" >&2; exit 1; fi
+      git reset --hard "$sha"
     # Report ok (no-change) when the tree was already at the requested
     # ref — saves a noisy CHANGED status line on no-op reruns.
-    changed_when: '[ "$(cd {{ build_dir }} && git rev-parse HEAD 2>/dev/null)" != "$(cd {{ build_dir }} && git rev-parse origin/{{ ref }} 2>/dev/null)" ]'
+    changed_when: '[ "$(cd {{ build_dir }} && git rev-parse HEAD)" != "$(cd {{ build_dir }} && (git rev-parse --verify --quiet "origin/{{ ref }}^{commit}" || git rev-parse --verify --quiet "{{ ref }}^{commit}"))" ]'
 
   # ── image build ─────────────────────────────────────────────────────
   - name: Build image {{ image_tag }}