diff --git a/.github/workflows/deploy-stack.yml b/.github/workflows/deploy-stack.yml
index 64636c3ea..45690ef20 100644
--- a/.github/workflows/deploy-stack.yml
+++ b/.github/workflows/deploy-stack.yml
@@ -160,7 +160,12 @@ jobs:
 
                     cd "${APP_DIR}"
                     git fetch --prune --tags origin
-                    git checkout --detach "origin/${BRANCH}"
+                    # tag deploys pass the tag name, which has no origin/ ref
+                    if git rev-parse --verify -q "origin/${BRANCH}" >/dev/null; then
+                      git checkout --detach "origin/${BRANCH}"
+                    else
+                      git checkout --detach "refs/tags/${BRANCH}"
+                    fi
 
                     cd infra
                     umask 077
diff --git a/.github/workflows/on_tag.yml b/.github/workflows/on_tag.yml
index dbfab8130..519b6d398 100644
--- a/.github/workflows/on_tag.yml
+++ b/.github/workflows/on_tag.yml
@@ -82,7 +82,7 @@ jobs:
             action: deploy
             image_tag: ${{ github.ref_name }}
             stack_name: pubstar
-            hostname: ${{ vars.PROD_HOSTNAME }}
+            hostname: app.pubstar.org
             env_file: .env.enc
             stack_file: stack.yml
             uses_gateway: false