diff --git a/.github/workflows/prod-deploy.yml b/.github/workflows/prod-deploy.yml
index 0d600162..99fd06c6 100644
--- a/.github/workflows/prod-deploy.yml
+++ b/.github/workflows/prod-deploy.yml
@@ -107,10 +107,14 @@ jobs:
       # the next step auto-rolls back the prod alias to the previous good
       # deploy. This catches the class of bug that bled SEO on 2026-06-25
       # (bench page 404 + noindex while still in the sitemap).
+      #
+      # Sitemap fetched from deployment URL (bypasses s-maxage=3600 CDN
+      # cache on /sitemap.xml which was causing false rollbacks). Pages
+      # checked against prod domain so preview-URL noindex doesn't fail.
       - name: Sitemap indexability smoke
         id: smoke
         continue-on-error: true
-        run: node scripts/sitemap-smoke.mjs https://openchainbench.com
+        run: node scripts/sitemap-smoke.mjs ${{ steps.deploy.outputs.url }} https://openchainbench.com
 
       - name: Auto-rollback on smoke failure
         if: steps.smoke.outcome == 'failure'
diff --git a/scripts/sitemap-smoke.mjs b/scripts/sitemap-smoke.mjs
index b39a75bc..8f7786ec 100644
--- a/scripts/sitemap-smoke.mjs
+++ b/scripts/sitemap-smoke.mjs
@@ -26,10 +26,17 @@
 
 const base = process.argv[2];
 if (!base) {
-  console.error("Usage: node scripts/sitemap-smoke.mjs <base-url>");
+  console.error("Usage: node scripts/sitemap-smoke.mjs <base-url> [check-host]");
   process.exit(2);
 }
 
+// Optional second arg: host to check individual page URLs against.
+// Useful when <base-url> is a Vercel preview URL (which emits noindex on
+// every page by design) but the sitemap itself should be fetched fresh
+// from that deployment to bypass CDN caching on the prod domain.
+// If omitted, page URLs are rewritten to use the same host as <base-url>.
+const checkHost = process.argv[3] ? new URL(process.argv[3]).origin : null;
+
 const CONCURRENCY = Number(process.env.SMOKE_CONCURRENCY ?? 8);
 const TIMEOUT_MS = Number(process.env.SMOKE_TIMEOUT_MS ?? 20000);
 const SKIP_REGEX = process.env.SMOKE_SKIP_REGEX
@@ -87,10 +94,13 @@ if (locs.length === 0) {
   process.exit(1);
 }
 
-// Rewrite each URL's host to match the target base, so a smoke test
-// against a Vercel preview URL still exercises the right deployment
-// rather than hitting prod.
-const targetHost = new URL(base).origin;
+// Rewrite each URL's host: use checkHost if provided (prod domain for
+// page checks when sitemap was fetched from a preview URL), otherwise
+// fall back to the same host as base.
+const targetHost = checkHost ?? new URL(base).origin;
+if (checkHost) {
+  console.log(`[smoke] checking pages against ${targetHost} (sitemap from deploy URL)`);
+}
 const urls = locs.map((u) => {
   try {
     const parsed = new URL(u);