diff --git a/.gitea/workflows/deploy.yml b/.gitea/workflows/deploy.yml
index 1eabf35..6175090 100644
--- a/.gitea/workflows/deploy.yml
+++ b/.gitea/workflows/deploy.yml
@@ -52,4 +52,4 @@ jobs:
             -o ConnectTimeout=10 \
             -p "$SSH_PORT" \
             "$SSH_USER@$SSH_HOST" \
-            "bash -lc 'set -euo pipefail; TS=\$(date +\"%Y-%m-%d_%H%M%S\"); SRC=\"/var/www/miriamgemeinde/public/images\"; DEST_BASE=\"/home/torsten/miriamgemeinde/backup/\$TS\"; mkdir -p \"\$DEST_BASE\"; if [ -d \"\$SRC\" ]; then cp -a \"\$SRC\" \"\$DEST_BASE/\"; echo \"Backed up \$SRC -> \$DEST_BASE/images\"; else echo \"WARN: \$SRC does not exist; skipping backup\"; fi; /home/torsten/update-miriamgemeinde.sh'"
+            "bash -lc 'set -euo pipefail; TS=\$(date +\"%Y-%m-%d_%H%M%S\"); SRC=\"/var/www/miriamgemeinde/public/images\"; DEST_BASE=\"/home/torsten/miriamgemeinde/backup/\$TS\"; mkdir -p \"\$DEST_BASE\"; if [ -d \"\$SRC\" ]; then cp -a \"\$SRC\" \"\$DEST_BASE/\"; echo \"Backed up \$SRC -> \$DEST_BASE/images\"; else echo \"WARN: \$SRC does not exist; skipping backup\"; fi; cd /home/torsten/miriamgemeinde && ./deploy.sh'"
diff --git a/deploy.sh b/deploy.sh
index f0b5111..83ddfd7 100755
--- a/deploy.sh
+++ b/deploy.sh
@@ -26,6 +26,17 @@ mkdir -p public || true
 cp -R dist/* public/ || { err "copy dist failed"; exit 1; }
 
 log "Restarting service miriamgemeinde..."
-sudo systemctl restart miriamgemeinde || { err "service restart failed"; exit 1; }
+if [ "${EUID:-$(id -u)}" -eq 0 ]; then
+  systemctl restart miriamgemeinde || { err "service restart failed"; exit 1; }
+else
+  # Non-interactive deploys (CI) must not prompt for a sudo password.
+  # Configure on the server (recommended):
+  #   sudo visudo -f /etc/sudoers.d/miriamgemeinde
+  #   torsten ALL=NOPASSWD:/bin/systemctl restart miriamgemeinde,/bin/systemctl status miriamgemeinde
+  sudo -n systemctl restart miriamgemeinde || {
+    err "service restart failed (no password prompt). Configure passwordless sudo for 'systemctl restart miriamgemeinde' or run deploy as root."
+    exit 1
+  }
+fi
 
 log "Deployment completed successfully."