diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml
index 62530611c..e707967e8 100644
--- a/.github/workflows/deploy.yml
+++ b/.github/workflows/deploy.yml
@@ -17,10 +17,21 @@ jobs:
     outputs:
       matrix: ${{ steps.filter.outputs.matrix }}
     steps:
+      - name: Harden git for flaky self-hosted network
+        run: |
+          git config --global http.version HTTP/1.1
+          git config --global http.postBuffer 524288000
+          git config --global http.lowSpeedLimit 0
+          git config --global http.lowSpeedTime 999999
+
       - name: Checkout
         uses: actions/checkout@v4
         with:
+          # Depth 2 so the changed-services diff (HEAD^..HEAD) works.
           fetch-depth: 2
+          # Partial clone: fetch blobs lazily instead of one huge pack — avoids
+          # the "Recv failure / early EOF" resets on the self-hosted runner.
+          filter: blob:none
 
       - name: Determine changed services
         id: filter
@@ -103,8 +114,20 @@ jobs:
       COMPOSE_DOCKER_CLI_BUILD: "1"
 
     steps:
+      - name: Harden git for flaky self-hosted network
+        run: |
+          git config --global http.version HTTP/1.1
+          git config --global http.postBuffer 524288000
+          git config --global http.lowSpeedLimit 0
+          git config --global http.lowSpeedTime 999999
+
       - name: Checkout
         uses: actions/checkout@v4
+        with:
+          # Deploy only needs the current tree, not full history — the default
+          # (unlimited depth) fetched a huge pack and reset on this runner.
+          fetch-depth: 1
+          filter: blob:none
 
       - name: Resolve project and build env file
         run: |