diff --git a/.github/workflows/build-docker-images.yml b/.github/workflows/build-docker-images.yml
index 46269f1..f12171b 100644
--- a/.github/workflows/build-docker-images.yml
+++ b/.github/workflows/build-docker-images.yml
@@ -118,7 +118,14 @@ jobs:
           username: ${{ secrets.SSH_USER }}
           key: ${{ secrets.GIMLI_KEY }}
           port: ${{ secrets.SSH_PORT }}
-          script: 'docker compose down && docker compose pull && docker compose up -d'
+          # Pull first, then reconcile in place with `up -d`. Avoid `compose down`:
+          # it removes caddy_cf and the default network, which severs the SSH
+          # session's own path before `up` can restore it (intermittent
+          # "remote command exited without exit status"). `up -d` only recreates
+          # containers whose image/config changed and never tears the network out
+          # from under the connection. --force-recreate ensures the new :latest
+          # image is picked up even when the tag digest changed.
+          script: 'docker compose pull && docker compose up -d --force-recreate --remove-orphans'
 
       - name: NetBird diagnostics & disconnect
         # Runs even on failure: captures final state for debugging and tears the