diff --git a/.github/workflows/bot.yml b/.github/workflows/bot.yml
index e99ad1b35..3c52b52ce 100644
--- a/.github/workflows/bot.yml
+++ b/.github/workflows/bot.yml
@@ -58,27 +58,25 @@ jobs:
           cache-from: type=gha,scope=${{ github.ref_name }}-bot
           cache-to: type=gha,mode=max,scope=${{ github.ref_name }}-bot
 
-  deploy:
+  dispatch-deploy:
+    # See server.yml for rationale — deploy logs live in the private tachi-deploy repo.
     runs-on: ubuntu-latest
     needs: [docker-push]
     if: ${{ github.ref == 'refs/heads/main' && (github.event_name == 'push' || github.event_name == 'workflow_dispatch') }}
     strategy:
       fail-fast: false
-      max-parallel: 1
       matrix:
         destination: [boku, kamai, dev]
     steps:
-      - name: Enable SSH
+      - name: Dispatch deploy
         env:
-          SSH_PRIVATE_KEY: ${{ secrets.SSH_PRIVATE_KEY }}
-          SSH_KNOWN_HOSTS: ${{ secrets.SSH_KNOWN_HOSTS }}
+          GH_TOKEN: ${{ secrets.DEPLOY_DISPATCH_TOKEN }}
+          DEST: ${{ matrix.destination }}
+          SHA: ${{ github.sha }}
         run: |
-          mkdir -p ~/.ssh
-          printf '%s' "$SSH_PRIVATE_KEY" > ~/.ssh/id_rsa
-          chmod 600 ~/.ssh/id_rsa
-          printf '%s' "$SSH_KNOWN_HOSTS" > ~/.ssh/known_hosts
-
-      - name: Deploy updates
-        env:
-          TACHI_HOST: ${{ secrets.TACHI_HOST }}
-        run: ssh "ci@${TACHI_HOST}" "/home/ci/tachi-deploy/operations/deploy.sh bot ${{ matrix.destination }} ${{ github.sha }}"
+          gh api repos/zkldi/tachi-deploy/dispatches \
+            -f event_type=deploy \
+            -F "client_payload[app]=bot" \
+            -F "client_payload[dest]=${DEST}" \
+            -F "client_payload[sha]=${SHA}"
+          echo "::notice::Dispatched bot@${DEST} ${SHA} — logs: https://github.com/zkldi/tachi-deploy/actions/workflows/deploy.yml"
diff --git a/.github/workflows/database-seeds.yml b/.github/workflows/database-seeds.yml
index 6cd47f6ba..4e10c01d2 100644
--- a/.github/workflows/database-seeds.yml
+++ b/.github/workflows/database-seeds.yml
@@ -42,25 +42,20 @@ jobs:
         env:
           NODE_ENV: "test"
 
-  deploy:
+  dispatch-deploy:
+    # See ../workflows/server.yml for rationale — deploy logs live in tachi-deploy.
     runs-on: ubuntu-latest
     needs: [test]
     if: ${{ github.ref == 'refs/heads/main' && (github.event_name == 'push' || github.event_name == 'workflow_dispatch') }}
-    concurrency:
-      group: "seeds-lock-${{ github.sha }}"
-      cancel-in-progress: false
     steps:
-      - name: Enable SSH
+      - name: Dispatch seeds deploy
         env:
-          SSH_PRIVATE_KEY: ${{ secrets.SSH_PRIVATE_KEY }}
-          SSH_KNOWN_HOSTS: ${{ secrets.SSH_KNOWN_HOSTS }}
+          GH_TOKEN: ${{ secrets.DEPLOY_DISPATCH_TOKEN }}
+          SHA: ${{ github.sha }}
         run: |
-          mkdir -p ~/.ssh
-          printf '%s' "$SSH_PRIVATE_KEY" > ~/.ssh/id_rsa
-          chmod 600 ~/.ssh/id_rsa
-          printf '%s' "$SSH_KNOWN_HOSTS" > ~/.ssh/known_hosts
-
-      - name: Deploy seeds
-        env:
-          TACHI_HOST: ${{ secrets.TACHI_HOST }}
-        run: ssh -i ~/.ssh/id_rsa "ci@${TACHI_HOST}" /home/ci/tachi-deploy/operations/deploy-seeds.sh "${{ github.sha }}"
+          gh api repos/zkldi/tachi-deploy/dispatches \
+            -f event_type=deploy \
+            -F "client_payload[app]=seeds" \
+            -F "client_payload[dest]=-" \
+            -F "client_payload[sha]=${SHA}"
+          echo "::notice::Dispatched seeds ${SHA} — logs: https://github.com/zkldi/tachi-deploy/actions/workflows/deploy.yml"
diff --git a/.github/workflows/github-bot.yml b/.github/workflows/github-bot.yml
index 72f276db9..b292906b6 100644
--- a/.github/workflows/github-bot.yml
+++ b/.github/workflows/github-bot.yml
@@ -57,22 +57,20 @@ jobs:
           cache-from: type=gha,scope=${{ github.ref_name }}-github-bot
           cache-to: type=gha,mode=max,scope=${{ github.ref_name }}-github-bot
 
-  deploy:
+  dispatch-deploy:
+    # See server.yml for rationale — deploy logs live in the private tachi-deploy repo.
     runs-on: ubuntu-latest
     needs: [docker-push]
     if: ${{ github.ref == 'refs/heads/main' && (github.event_name == 'push' || github.event_name == 'workflow_dispatch') }}
     steps:
-      - name: Enable SSH
+      - name: Dispatch deploy
         env:
-          SSH_PRIVATE_KEY: ${{ secrets.SSH_PRIVATE_KEY }}
-          SSH_KNOWN_HOSTS: ${{ secrets.SSH_KNOWN_HOSTS }}
+          GH_TOKEN: ${{ secrets.DEPLOY_DISPATCH_TOKEN }}
+          SHA: ${{ github.sha }}
         run: |
-          mkdir -p ~/.ssh
-          printf '%s' "$SSH_PRIVATE_KEY" > ~/.ssh/id_rsa
-          chmod 600 ~/.ssh/id_rsa
-          printf '%s' "$SSH_KNOWN_HOSTS" > ~/.ssh/known_hosts
-
-      - name: Deploy updates
-        env:
-          TACHI_HOST: ${{ secrets.TACHI_HOST }}
-        run: ssh "ci@${TACHI_HOST}" "/home/ci/tachi-deploy/operations/deploy.sh ghbot - ${{ github.sha }}"
+          gh api repos/zkldi/tachi-deploy/dispatches \
+            -f event_type=deploy \
+            -F "client_payload[app]=ghbot" \
+            -F "client_payload[dest]=-" \
+            -F "client_payload[sha]=${SHA}"
+          echo "::notice::Dispatched ghbot ${SHA} — logs: https://github.com/zkldi/tachi-deploy/actions/workflows/deploy.yml"
diff --git a/.github/workflows/server.yml b/.github/workflows/server.yml
index aa188c529..ddb5572bc 100644
--- a/.github/workflows/server.yml
+++ b/.github/workflows/server.yml
@@ -150,29 +150,30 @@ jobs:
           cache-from: type=gha,scope=server-${{ github.ref_name }}
           cache-to: type=gha,mode=max,scope=server-${{ github.ref_name }}
 
-  deploy:
+  dispatch-deploy:
+    # Fire a repository_dispatch at tachi-deploy (private). That repo's workflow
+    # owns the SSH key and Kamal output — keeping deploy logs out of this
+    # public repo. See tachi-deploy/.github/workflows/deploy.yml.
     runs-on: ubuntu-latest
     needs: [test, docker-push]
     if: ${{ github.ref == 'refs/heads/main' && (github.event_name == 'push' || github.event_name == 'workflow_dispatch') }}
     strategy:
       fail-fast: false
-      max-parallel: 1
       matrix:
         destination: [boku, kamai, dev]
     permissions:
       contents: read
     steps:
-      - name: Enable SSH
+      - name: Dispatch deploy
         env:
-          SSH_PRIVATE_KEY: ${{ secrets.SSH_PRIVATE_KEY }}
-          SSH_KNOWN_HOSTS: ${{ secrets.SSH_KNOWN_HOSTS }}
+          # Fine-grained PAT, repo-scoped to zkldi/tachi-deploy, Contents: write.
+          GH_TOKEN: ${{ secrets.DEPLOY_DISPATCH_TOKEN }}
+          DEST: ${{ matrix.destination }}
+          SHA: ${{ github.sha }}
         run: |
-          mkdir -p ~/.ssh
-          printf '%s' "$SSH_PRIVATE_KEY" > ~/.ssh/id_rsa
-          chmod 600 ~/.ssh/id_rsa
-          printf '%s' "$SSH_KNOWN_HOSTS" > ~/.ssh/known_hosts
-
-      - name: Deploy on server
-        env:
-          TACHI_HOST: ${{ secrets.TACHI_HOST }}
-        run: ssh "ci@${TACHI_HOST}" "/home/ci/tachi-deploy/operations/deploy.sh server ${{ matrix.destination }} ${{ github.sha }}"
+          gh api repos/zkldi/tachi-deploy/dispatches \
+            -f event_type=deploy \
+            -F "client_payload[app]=server" \
+            -F "client_payload[dest]=${DEST}" \
+            -F "client_payload[sha]=${SHA}"
+          echo "::notice::Dispatched server@${DEST} ${SHA} — logs: https://github.com/zkldi/tachi-deploy/actions/workflows/deploy.yml"