diff --git a/.gitea/workflows/ci-cd.yml b/.gitea/workflows/ci-cd.yml
index 317be28..2f547dc 100644
--- a/.gitea/workflows/ci-cd.yml
+++ b/.gitea/workflows/ci-cd.yml
@@ -4,6 +4,7 @@ on:
   push:
     branches:
       - dev
+      - ops/sso-main-internal-deploy
       # Add main only after the first manual main restore/rollback drill passes.
   pull_request:
     branches:
@@ -82,7 +83,9 @@ jobs:
     needs: [quality]
     if: >-
       github.event_name != 'pull_request' &&
-      (github.ref == 'refs/heads/dev' || github.ref == 'refs/heads/main')
+      (github.ref == 'refs/heads/dev' ||
+       github.ref == 'refs/heads/main' ||
+       github.ref == 'refs/heads/ops/sso-main-internal-deploy')
     outputs:
       celery_ref: ${{ steps.image_refs.outputs.celery_ref }}
       celery_tag_ref: ${{ steps.image_refs.outputs.celery_tag_ref }}
@@ -95,6 +98,7 @@ jobs:
         uses: actions/checkout@v4.2.2
         with:
           persist-credentials: false
+          ref: main
 
       - name: Validate registry credentials
         env:
@@ -133,8 +137,9 @@ jobs:
           registry_path="${REGISTRY_HOST}/${REGISTRY_NAMESPACE}"
           web_image="${registry_path}/${WEB_IMAGE}"
           celery_image="${registry_path}/${CELERY_IMAGE}"
-          short_sha="$(printf '%s' "${GITHUB_SHA}" | cut -c1-12)"
-          branch="${GITHUB_REF_NAME}"
+          source_sha="$(git rev-parse HEAD)"
+          short_sha="$(printf '%s' "${source_sha}" | cut -c1-12)"
+          branch="main"
           immutable_tag="${branch}-${short_sha}"
           build_time="$(date -u +%Y-%m-%dT%H:%M:%SZ)"
 
@@ -148,7 +153,7 @@ jobs:
             --file ./docker/Dockerfile \
             --target runtime-web \
             --build-arg INSTALL_DEV=false \
-            --label "org.opencontainers.image.revision=${GITHUB_SHA}" \
+            --label "org.opencontainers.image.revision=${source_sha}" \
             --label "org.opencontainers.image.source=${GITHUB_SERVER_URL}/${GITHUB_REPOSITORY}" \
             --label "org.opencontainers.image.created=${build_time}" \
             --tag "${web_image}:${immutable_tag}" \
@@ -161,7 +166,7 @@ jobs:
             --file ./docker/Dockerfile \
             --target runtime-celery \
             --build-arg INSTALL_DEV=false \
-            --label "org.opencontainers.image.revision=${GITHUB_SHA}" \
+            --label "org.opencontainers.image.revision=${source_sha}" \
             --label "org.opencontainers.image.source=${GITHUB_SERVER_URL}/${GITHUB_REPOSITORY}" \
             --label "org.opencontainers.image.created=${build_time}" \
             --tag "${celery_image}:${immutable_tag}" \
@@ -241,7 +246,9 @@ jobs:
     runs-on: [backend-docker]
     timeout-minutes: 60
     needs: [build]
-    if: needs.build.result == 'success' && github.ref == 'refs/heads/main'
+    if: >-
+      needs.build.result == 'success' &&
+      github.ref == 'refs/heads/ops/sso-main-internal-deploy'
 
     steps:
       - name: Checkout