diff --git a/.gitea/workflows/ci.yml b/.gitea/workflows/ci.yml
index 61a5c85..8a145d2 100644
--- a/.gitea/workflows/ci.yml
+++ b/.gitea/workflows/ci.yml
@@ -104,16 +104,12 @@ jobs:
         if: github.event_name == 'push' && github.ref == 'refs/heads/main'
         run: docker push "$IMAGE:latest"
 
-  # The stack lives in the infrastructure repo and Portainer deploys it from
-  # there, so a rollout is a commit in that repo: it pins the findr-api image to
-  # this build's commit. Compose then recreates the one service whose image
-  # changed. Leaving the stack on ":latest" and only re-pulling would drag
-  # findr-web and postgres along with every api deploy, and nothing in Git would
-  # say which version is running.
-  #
-  # Pushing the commit is the whole job - Portainer polls the repo and redeploys
-  # once it sees a new head. A green job therefore means the rollout was handed
-  # over, not that it has happened yet.
+  # The stack lives in the infrastructure repo, so a rollout is a commit in that
+  # repo: it pins the findr-api image to this build's commit. Then the Portainer
+  # stack webhook is called, which re-pulls the repo and recreates the one
+  # service whose image changed. Leaving the stack on ":latest" and only
+  # re-pulling would drag findr-web and postgres along with every api deploy, and
+  # nothing in Git would say which version is running.
   deploy:
     runs-on: ubuntu-latest
     timeout-minutes: 10
@@ -122,9 +118,10 @@ jobs:
     steps:
       # The token goes into the remote URL, so it must not be echoed - it can
       # write to the whole infrastructure repo. No "set -x" here either.
-      - name: Pin findr-api image in the stack
+      - name: Pin findr-api image and trigger the stack
         env:
           INFRA_TOKEN: ${{ secrets.INFRA_TOKEN }}
+          PORTAINER_WEBHOOK: ${{ secrets.PORTAINER_WEBHOOK }}
           TAG: ${{ needs.build-and-push.outputs.tag }}
         run: |
           set -euo pipefail
@@ -160,8 +157,17 @@ jobs:
           # findr-web writes to the same file, so a push can lose a race.
           # Rebasing and retrying beats failing a build whose image is already in
           # the registry.
+          pushed=
           for attempt in 1 2 3; do
-            git push && exit 0
+            if git push; then pushed=1; break; fi
             git pull --rebase
           done
-          exit 1
+          [ -n "$pushed" ] || exit 1
+
+          # No polling: tell Portainer to redeploy now. -k because :9443 serves a
+          # self-signed cert. The URL carries a secret, so it comes from a secret
+          # and is never printed.
+          if [ -z "${PORTAINER_WEBHOOK:-}" ]; then
+            echo "::error::PORTAINER_WEBHOOK secret is not set" && exit 1
+          fi
+          curl -fsS -k -X POST "$PORTAINER_WEBHOOK"