diff --git a/.forgejo/workflows/deploy.yml b/.forgejo/workflows/deploy.yml
index 3b5afb2..38b70b5 100644
--- a/.forgejo/workflows/deploy.yml
+++ b/.forgejo/workflows/deploy.yml
@@ -1,4 +1,3 @@
-
 name: Deploy on push
 
 on:
@@ -10,14 +9,14 @@ jobs:
     runs-on: docker2
     outputs:
       swarm_files: ${{ steps.changes.outputs.swarm_files }}
-      compose_matrix: ${{ steps.changes.outputs.compose_matrix }}
+      compose_files_matrix: ${{ steps.changes.outputs.compose_files_matrix }}
     steps:
       - name: Checkout
         uses: https://data.forgejo.org/actions/checkout@v4
         with:
           fetch-depth: 0
 
-      - name: Detect changed YAML deploy targets (YAML only)
+      - name: Detect changed YAML deploy targets (your naming)
         id: changes
         shell: bash
         run: |
@@ -32,7 +31,7 @@ jobs:
           if [ -z "${BASE}" ]; then
             echo "No base commit found; deploying nothing."
             echo "swarm_files=" >> "$GITHUB_OUTPUT"
-            echo 'compose_matrix={"include":[]}' >> "$GITHUB_OUTPUT"
+            echo 'compose_files_matrix={"include":[]}' >> "$GITHUB_OUTPUT"
             exit 0
           fi
 
@@ -44,36 +43,30 @@ jobs:
           SWARM_FILES_ONE_LINE="$(echo "$SWARM_FILES" | tr '\n' ' ' | xargs || true)"
           echo "swarm_files=$SWARM_FILES_ONE_LINE" >> "$GITHUB_OUTPUT"
 
-          # Compose: ONLY if compose YAML file changed inside a service dir
+          # Compose: any changed YAML under services/compose/<host>/<service>/
           COMPOSE_FILES="$(
             echo "$CHANGED" \
-              | grep -E '^services/compose/[^/]+/[^/]+/(compose|docker-compose)\.ya?ml$' \
-              | sort -u \
-              || true
-          )"
-
-          COMPOSE_DIRS="$(
-            echo "$COMPOSE_FILES" \
-              | awk -F/ '{print $1"/"$2"/"$3"/"$4}' \
+              | grep -E '^services/compose/[^/]+/[^/]+/.*\.ya?ml$' \
               | sort -u \
               || true
           )"
 
+          # Build matrix items: {"host":"nas","file":"services/compose/nas/foo/foo.yaml"}
           JSON='{"include":['
           FIRST=1
-          while read -r DIR; do
-            [ -z "$DIR" ] && continue
-            HOST="$(echo "$DIR" | awk -F/ '{print $3}')"
+          while read -r F; do
+            [ -z "$F" ] && continue
+            HOST="$(echo "$F" | awk -F/ '{print $3}')"
             if [ $FIRST -eq 1 ]; then
               FIRST=0
             else
               JSON+=","
             fi
-            JSON+="{\"host\":\"$HOST\",\"dir\":\"$DIR\"}"
-          done <<< "$COMPOSE_DIRS"
+            JSON+="{\"host\":\"$HOST\",\"file\":\"$F\"}"
+          done <<< "$COMPOSE_FILES"
           JSON+=']}'
 
-          echo "compose_matrix=$JSON" >> "$GITHUB_OUTPUT"
+          echo "compose_files_matrix=$JSON" >> "$GITHUB_OUTPUT"
 
   deploy_swarm:
     needs: detect
@@ -106,54 +99,41 @@ jobs:
 
   deploy_compose:
     needs: detect
-    if: ${{ needs.detect.outputs.compose_matrix != '' }}
+    if: ${{ needs.detect.outputs.compose_files_matrix != '' }}
     strategy:
       fail-fast: false
-      matrix: ${{ fromJSON(needs.detect.outputs.compose_matrix) }}
-    runs-on: ${{ matrix.host }}
+      matrix: ${{ fromJSON(needs.detect.outputs.compose_files_matrix) }}
+    runs-on: docker
     steps:
       - name: Checkout
         uses: https://data.forgejo.org/actions/checkout@v4
 
-      - name: Pre-flight validate compose service
+      - name: Ensure we are on the right host
         shell: bash
         run: |
           set -euo pipefail
-
-          DIR="${{ matrix.dir }}"
-          if [ -f "$DIR/compose.yml" ]; then
-            F="$DIR/compose.yml"
-          elif [ -f "$DIR/compose.yaml" ]; then
-            F="$DIR/compose.yaml"
-          elif [ -f "$DIR/docker-compose.yml" ]; then
-            F="$DIR/docker-compose.yml"
-          elif [ -f "$DIR/docker-compose.yaml" ]; then
-            F="$DIR/docker-compose.yaml"
-          else
-            echo "No compose file found in $DIR"
+          WANT="${{ matrix.host }}"
+          HAVE="$(hostname)"
+          echo "Want host: $WANT"
+          echo "Have host: $HAVE"
+          if [ "$WANT" != "$HAVE" ]; then
+            echo "This runner is on $HAVE but job wants $WANT. Failing to avoid deploying on wrong host."
             exit 1
           fi
 
+      - name: Pre-flight validate compose file
+        shell: bash
+        run: |
+          set -euo pipefail
+          F="${{ matrix.file }}"
+          echo "Validating compose file: $F"
           docker compose -f "$F" config -q
 
-      - name: Deploy compose service
+      - name: Deploy compose file
         shell: bash
         run: |
           set -euo pipefail
-
-          DIR="${{ matrix.dir }}"
-          if [ -f "$DIR/compose.yml" ]; then
-            F="$DIR/compose.yml"
-          elif [ -f "$DIR/compose.yaml" ]; then
-            F="$DIR/compose.yaml"
-          elif [ -f "$DIR/docker-compose.yml" ]; then
-            F="$DIR/docker-compose.yml"
-          elif [ -f "$DIR/docker-compose.yaml" ]; then
-            F="$DIR/docker-compose.yaml"
-          else
-            echo "No compose file found in $DIR"
-            exit 1
-          fi
-
+          F="${{ matrix.file }}"
+          echo "Deploying compose file: $F"
           docker compose -f "$F" pull
           docker compose -f "$F" up -d --remove-orphans