diff --git a/.gitea/workflows/ci.yml b/.gitea/workflows/ci.yml
index 98d0d31..45a839e 100644
--- a/.gitea/workflows/ci.yml
+++ b/.gitea/workflows/ci.yml
@@ -124,4 +124,12 @@ jobs:
           git diff --cached --quiet && { echo "no image change"; exit 0; }
           git commit -m "ci: deploy ${{ steps.tag.outputs.sha }} [skip ci]"
           git remote set-url origin "http://${{ github.repository_owner }}:${{ secrets.CI_TOKEN }}@10.66.15.22:3000/bmr_bluecap/bcs-website.git"
-          git push origin HEAD:main
+          # main may have moved since checkout (a later push, or a re-run of an older commit).
+          # Only kustomization.yaml changes here, so rebasing onto the new tip is safe.
+          for attempt in 1 2 3; do
+            git push origin HEAD:main && exit 0
+            echo "push rejected (main moved); rebasing onto origin/main, attempt $attempt"
+            git fetch --unshallow origin main 2>/dev/null || git fetch origin main
+            git rebase origin/main
+          done
+          exit 1