diff --git a/README.md b/README.md
index 80737e0..357a423 100644
--- a/README.md
+++ b/README.md
@@ -253,7 +253,8 @@ A push to `main` runs three gates in parallel - ruff and pytest, the frontend's
 tests and linters, and a smoke test over HTTP against the freshly built image - and only then builds
 for real: two images, `folderly-backend` and `folderly-web` (Caddy with the built SPA inside), each
 on native `amd64` and `arm64` runners, published to GHCR as one manifest per image under `latest`
-and `sha-<commit>`. Hosts follow `latest`, pinning a `sha-` tag is the rollback.
+and `sha-<commit>`, the full forty characters. Hosts follow `latest`, pinning a `sha-` tag is
+the rollback.
 
 **Nothing in the workflow names this account.** It publishes to
 `ghcr.io/<repository owner>/folderly-backend` and `-web`, so a fork builds its own pair under its
diff --git a/deploy/.env.example b/deploy/.env.example
index 02a5e62..3f4e8ad 100644
--- a/deploy/.env.example
+++ b/deploy/.env.example
@@ -6,7 +6,7 @@
 FOLDERLY_IMAGE=ghcr.io/OWNER/folderly-backend
 FOLDERLY_WEB_IMAGE=ghcr.io/OWNER/folderly-web
 
-# `latest` follows every green build; sha-abc1234 pins one commit, both images.
+# `latest` follows every green build, sha-<40-char commit> pins both images.
 IMAGE_TAG=latest
 
 # The domain Caddy certifies. Empty = plain HTTP on :80, for trying it locally.
diff --git a/docs/deployment.md b/docs/deployment.md
index fe37939..dab2ce8 100644
--- a/docs/deployment.md
+++ b/docs/deployment.md
@@ -172,9 +172,10 @@ journalctl -u folderly-update.service -f                   # what the timer did
 sudo systemctl start folderly-update.service               # update now, without waiting
 ```
 
-**Rolling back** is one line in `.env`: `IMAGE_TAG=sha-<commit>` from a build that worked, then
-`up -d` again. One tag covers both images, so a tested pair stays together. Go back to `latest`
-afterwards, or the timer holds the old version forever.
+**Rolling back** is one line in `.env`: `IMAGE_TAG=sha-<commit>` from a build that worked - the
+full forty characters, not the short form - then `up -d` again. One tag covers both images, so a
+tested pair stays together. Go back to `latest` afterwards, or the timer holds the old version
+forever.
 
 **When it does not come up**, in order of likelihood: the `chown` in step 2 was skipped (the
 container restart-loops on "unable to open database file"), port 80 does not reach the host from