diff --git a/.tangled/workflows/deploy.yml b/.tangled/workflows/deploy.yml
index d4e4b20..baadd0e 100644
--- a/.tangled/workflows/deploy.yml
+++ b/.tangled/workflows/deploy.yml
@@ -7,14 +7,20 @@
 # script. See deploy/deploy-on-push.sh and deploy/AUTOPUSH.md.
 #
 # This exists because an emulated amd64 build of the Erlang toolchain
-# crashes under QEMU (OTP#10355, see deploy/publish.sh) — so the actual
+# crashes under QEMU (OTP#10355, see deploy/publish.sh), so the actual
 # `docker build` has to happen natively on the droplet, same as it does
 # today for the manual deploy. Superseded by deploy-microvm.yml only if the
 # test-postgres.yml canary proves the hosted spindle's microVMs are
 # x86_64+KVM (native amd64 builds, no emulation).
+#
+# Manual until the canary decides the autopush path. To enable this
+# SSH-trigger path, set the secrets in deploy/AUTOPUSH.md and change `when`
+# to:
+#   when:
+#     - event: ["push"]
+#       branch: ["main"]
 when:
-  - event: ["push"]
-    branch: ["main"]
+  - event: ["manual"]
 
 engine: nixery