diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index cd81060..fe6481b 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -112,9 +112,13 @@ jobs:
           become wikitermbase bash << 'EOF'
           set -euo pipefail
 
-          echo "[DB] Pulling latest code from main"
+          echo "[DB] Syncing the checkout with main"
           cd ~/wikitermbase
-          git pull --ff-only origin main
+          # The checkout is a deploy mirror: match origin/main exactly, so that
+          # a leftover file (e.g. a dump downloaded by hand) can't block the
+          # update. Ignored files (var/) are kept.
+          git fetch origin main
+          git reset --hard origin/main
 
           echo "[DB] Importing db/arabterm.sql.gz"
           gzip -t db/arabterm.sql.gz
diff --git a/CLAUDE.md b/CLAUDE.md
index 8441e99..8a040d6 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -51,7 +51,7 @@ password = MyTestPassword
 
 CI ([.github/workflows/ci.yml](.github/workflows/ci.yml)) classifies pushed paths via `dorny/paths-filter` and runs one of two SSH-based deploy jobs into the Toolforge bastion (as personal user `forzagreen`, then `become wikitermbase`):
 - `deploy-code` runs on code changes: `toolforge build start` → poll `toolforge build show --json` for `status: ok` → `toolforge webservice buildservice restart`.
-- `deploy-db` runs when `db/arabterm.sql.gz` changed: `git pull --ff-only origin main` then `gunzip -c db/arabterm.sql.gz | mariadb ...`. The dump is committed gzipped because the unpacked file is over GitHub's limit of 100 MB per file.
+- `deploy-db` runs when `db/arabterm.sql.gz` changed: `git fetch origin main && git reset --hard origin/main` (the bastion checkout is only a deploy mirror; a plain pull failed once on a stray untracked `db/arabterm.sql.gz`) then `gunzip -c db/arabterm.sql.gz | mariadb ...`. The dump is committed gzipped because the unpacked file is over GitHub's limit of 100 MB per file.
 - Markdown-only changes skip both deploys.
 - `wikidata-stats` runs after `deploy-db` (and on "Run workflow"): [backend/wikidata_stats.py](backend/wikidata_stats.py) copies `/api/v1/stats` to Wikidata item [Q133800945](https://www.wikidata.org/wiki/Q133800945) as P4876 (number of records) = terms and P2670 (has part(s) of the class) = Q23622 dictionary + P1114 (quantity) = dictionaries. The two statements are overwritten in place, never appended (dumps refresh several times a week), and nothing is edited when the counts already match. [ويكيبيديا:مسرد الويكي](https://ar.wikipedia.org/wiki/ويكيبيديا:مسرد_الويكي) reads them with `{{#property:P4876}}` and `{{#invoke:WikidataIB|getQualifierValue|P2670|pval=Q23622|qual=P1114|...}}`, so don't change the properties without updating that page.