diff --git a/.gitea/workflows/deploy-prod.yml b/.gitea/workflows/deploy-prod.yml
index 5211d4c..b970d50 100644
--- a/.gitea/workflows/deploy-prod.yml
+++ b/.gitea/workflows/deploy-prod.yml
@@ -29,8 +29,10 @@ jobs:
             docker pull "$IMAGE:$TAG"
             docker tag "$IMAGE:$TAG" golfgame-app:latest
 
-            # Update code for compose/env changes
-            git fetch origin
+            # Update code for compose/env changes. `--tags --force` so a
+            # moved tag (hotfix on top of existing version) updates locally
+            # instead of silently checking out the stale cached position.
+            git fetch origin --tags --force
             git checkout "$TAG"
 
             # Restart app
diff --git a/.gitea/workflows/deploy-staging.yml b/.gitea/workflows/deploy-staging.yml
index 615bc4c..bb99d57 100644
--- a/.gitea/workflows/deploy-staging.yml
+++ b/.gitea/workflows/deploy-staging.yml
@@ -21,8 +21,11 @@ jobs:
 
             cd /opt/golfgame
 
-            # Pull latest code and checkout the release tag
-            git fetch origin
+            # Pull latest code and checkout the release tag. `--tags --force`
+            # so that a tag moved on origin (e.g. hotfix on top of an existing
+            # version) actually updates locally instead of silently reusing a
+            # stale cached tag position.
+            git fetch origin --tags --force
             git checkout "$TAG"
 
             # Build the image