diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml
index 70e5fbe..a35c3ea 100644
--- a/.github/workflows/deploy.yml
+++ b/.github/workflows/deploy.yml
@@ -134,6 +134,14 @@ jobs:
           fi
           git -C "$SRC" fetch --depth 1 origin "$BRANCH"
           git -C "$SRC" reset --hard "origin/$BRANCH"
+          # Preempt the self-update timer. It redeploys from source (no
+          # SKIP_BUILD) and can hold setup.sh's flock for >5min while compiling
+          # on this tiny droplet, which would starve and time out the deploy
+          # below. This CI push is authoritative (prebuilt binaries + reset to
+          # the exact commit), so stop any in-flight timer run to release the
+          # lock and pause the timer so it can't re-fire mid-deploy; setup.sh
+          # re-enables the timer at the end of its run.
+          systemctl stop agentbbs-update.timer agentbbs-update.service 2>/dev/null || true
           # Install the runner-built binaries, then tell setup.sh not to compile.
           install -m 0755 /tmp/agentbbs-deploy-agentbbs   /usr/local/bin/agentbbs
           install -m 0755 /tmp/agentbbs-deploy-ascii-live /usr/local/bin/ascii-live
diff --git a/internal/files/files_test.go b/internal/files/files_test.go
index c73e81a..577cce5 100644
--- a/internal/files/files_test.go
+++ b/internal/files/files_test.go
@@ -173,6 +173,7 @@ func TestWebSaveOverQuotaPreservesExistingFile(t *testing.T) {
 	svc, _, u := newTestService(t)
 	sess, _ := svc.newSession(u)
 	sess.quota = 5
+	sess.used.Store(0) // isolate the writer from the seeded-README baseline
 
 	if _, err := sess.webSave("/me/note.txt", strings.NewReader("ok")); err != nil {
 		t.Fatalf("initial save failed: %v", err)