diff --git a/deploy/push-workers.sh b/deploy/push-workers.sh
index d5e84d7..1782728 100755
--- a/deploy/push-workers.sh
+++ b/deploy/push-workers.sh
@@ -12,16 +12,23 @@ rsync -avz --delete \
   --exclude __pycache__ \
   --exclude '*.egg-info' \
   --exclude tests \
+  --exclude .env \
+  --exclude .gitignore \
+  --exclude .pytest_cache \
   workers/ "$TARGET:$REMOTE_DIR/"
 
 ssh "$TARGET" "
-  cd $REMOTE_DIR
-  if [ ! -d venv ]; then
-    python3.12 -m venv venv
-  fi
-  . venv/bin/activate
-  pip install --quiet --upgrade pip
-  pip install --quiet -e '.[all]'
+  # rsync runs as root → files land root-owned. Workers run as voidworkers.
+  chown -R voidworkers: $REMOTE_DIR
+  su voidworkers -c '
+    cd $REMOTE_DIR
+    if [ ! -d venv ]; then
+      python3 -m venv venv
+    fi
+    . venv/bin/activate
+    pip install --quiet --upgrade pip
+    pip install --quiet -e \".[all]\"
+  '
   systemctl restart void-workers
 "
 echo "Workers deployed."