diff --git a/.github/workflows/build-image.yml b/.github/workflows/build-image.yml
index 1356c8df5..f7e204159 100644
--- a/.github/workflows/build-image.yml
+++ b/.github/workflows/build-image.yml
@@ -2,9 +2,7 @@ name: Build image
 
 on:
   push:
-    # chore/simplify-deployment is temporary, for pre-merge testing of this
-    # workflow itself — remove before merge
-    branches: ["develop", "master", "demo", "chore/simplify-deployment"]
+    branches: ["develop", "master"]
     tags: ["v*"]
   workflow_dispatch:
 
@@ -64,8 +62,8 @@ jobs:
           cache-from: type=gha
           cache-to: type=gha,mode=max
 
-  # The hosted demo/staging instances share one host and one compose file; a
-  # deploy recreates whichever service's image tag was just pushed.
+  # The hosted staging/prod instances share one host and one compose file; each
+  # deploy pulls and recreates only its own service.
   deploy-staging:
     needs: build-and-push
     if: github.ref == 'refs/heads/develop'
@@ -81,13 +79,13 @@ jobs:
             cd checkmate
             git pull
             cd docs/hosting/checkmate-so
-            docker compose pull
-            docker compose up -d
+            docker compose pull checkmate-staging
+            docker compose up -d checkmate-staging
             docker system prune -af
 
-  deploy-demo:
+  deploy-prod:
     needs: build-and-push
-    if: github.ref == 'refs/heads/demo'
+    if: github.ref == 'refs/heads/master'
     runs-on: ubuntu-latest
     steps:
       - name: Deploy demo.checkmate.so
@@ -100,6 +98,6 @@ jobs:
             cd checkmate
             git pull
             cd docs/hosting/checkmate-so
-            docker compose pull
-            docker compose up -d
+            docker compose pull checkmate-demo
+            docker compose up -d checkmate-demo
             docker system prune -af
diff --git a/docs/hosting/checkmate-so/README.md b/docs/hosting/checkmate-so/README.md
index d2a89cf09..2a7e9f648 100644
--- a/docs/hosting/checkmate-so/README.md
+++ b/docs/hosting/checkmate-so/README.md
@@ -12,13 +12,16 @@ image behind a TLS reverse proxy.
 ## How deploys work
 
 `.github/workflows/build-image.yml` builds and pushes the image, then SSHes in
-and runs `docker compose pull && docker compose up -d` in this directory:
+and runs `docker compose pull <service> && docker compose up -d <service>` in
+this directory:
 
-- push to `develop` → image tagged `:develop` → `checkmate-staging` recreated
-- push to `demo` → image tagged `:demo` → `checkmate-demo` recreated
+- merge to `develop` → image tagged `:develop` → `checkmate-staging` recreated
+- merge to `master` → image tagged `:master` → `checkmate-demo` (prod) recreated
 
-The host keeps a git checkout of this repo; the deploy does `git pull` first so
-compose/gateway changes land with the code.
+The host keeps a git checkout of this repo (on `develop`); the deploy does
+`git pull` first so compose changes land with the code. Note the deploy only
+recreates the checkmate service — changes to `gateway/nginx.conf` or the mongo
+services need a manual `docker compose up -d` / gateway restart on the host.
 
 ## Host-local files (not committed)
 
diff --git a/docs/hosting/checkmate-so/docker-compose.yaml b/docs/hosting/checkmate-so/docker-compose.yaml
index 65bee76d1..96849fecb 100644
--- a/docs/hosting/checkmate-so/docker-compose.yaml
+++ b/docs/hosting/checkmate-so/docker-compose.yaml
@@ -20,9 +20,9 @@ services:
       - /etc/letsencrypt:/etc/nginx/ssl:ro
       - ./gateway/nginx.conf:/etc/nginx/conf.d/default.conf:ro
 
-  # Demo: demo.checkmate.so -----
+  # Prod: demo.checkmate.so -----
   checkmate-demo:
-    image: ghcr.io/bluewave-labs/checkmate:demo
+    image: ghcr.io/bluewave-labs/checkmate:master
     container_name: checkmate-demo
     restart: always
     env_file: