diff --git a/README.md b/README.md
index c8c0d15..f4a50b6 100644
--- a/README.md
+++ b/README.md
@@ -76,9 +76,10 @@ that is how new permissions reach the existing roles.
 | Deploy to one version / several / all | no notion of versions at all | yes; each version keeps its own pinned ref |
 | Cut a new core version | by hand, then re-clone ~100 extensions one by one | one form: reconstruct from an existing version |
 | **Undeploy** an extension, skin or version | no concept of it | yes, per version, behind its own permissions |
+| Ship staging as it stands | the only mode there was | yes, as an explicit mode behind its own permission |
 | Deploy history | last run only, in `/var/log/mwdeploy-state.json` | every run, queryable |
 | Rollback | no concept of it | yes — and it reverses removals as well as ref changes |
-| Users and permissions | whoever is on the Salt master shell | accounts, roles, 21 permissions across the console and its apps, enforced TOTP |
+| Users and permissions | whoever is on the Salt master shell | accounts, roles, 22 permissions across the console and its apps, enforced TOTP |
 | Patch consistency | `--patch`/`--patch-target` retyped each time | registry; target path stored on the patch |
 | Repo registration | by hand on disk | form, with a reachability check, then a reviewable clone |
 | Adopting an existing farm | n/a — the CLI *was* the farm's history | `tree-scan` reads the tree and fills the registry in from it |
@@ -207,6 +208,21 @@ Removal is a **separate grant** from deployment throughout
 (`deploy.undeploy_extension`, `deploy.undeploy_skin`, `deploy.undeploy_version`),
 and every removal is reversible — see below.
 
+### Deploying staging as it stands
+
+**Sync staging** (`/deployments/sync`) deploys the staging tree exactly as it is
+on disk: no fetch, no checkout, no selection. It is the escape hatch for work that
+never came from a ref — a file edited directly on staging, a patch applied by
+hand, a checkout repaired in place — and the plan is just the rsync of the whole
+tree, plus the same canary gate and depool/repool rollout every other deployment
+gets.
+
+Two things follow from having no line items. It is **not** scoped to a repository,
+so it ships whatever anyone else has staged too and is gated on its own permission
+(`deploy.sync_staging`) rather than on the per-type deploy grants. And it records
+no refs, so there is no undo point: rollback is not offered for it, and the way
+back is another deployment.
+
 ## Layout
 
 ```
diff --git a/app/Actions/Deployments/CreateDeployment.php b/app/Actions/Deployments/CreateDeployment.php
index 19405fd..3ce0292 100644
--- a/app/Actions/Deployments/CreateDeployment.php
+++ b/app/Actions/Deployments/CreateDeployment.php
@@ -55,8 +55,8 @@ public function __invoke(
             }
 
             // Patches are only meaningful on the way in; a removal has nothing
-            // left to patch.
-            if ($intent !== DeploymentIntent::Undeploy) {
+            // left to patch, and a staging sync ships whatever is already there.
+            if ($intent->carriesPatches()) {
                 foreach (Patch::query()->whereIn('id', $patchIds)->get() as $patch) {
                     $deployment->deploymentPatches()->create([
                         'patch_id' => $patch->getKey(),
diff --git a/app/Enums/DeploymentIntent.php b/app/Enums/DeploymentIntent.php
index a2fcfa4..ecc9546 100644
--- a/app/Enums/DeploymentIntent.php
+++ b/app/Enums/DeploymentIntent.php
@@ -15,6 +15,17 @@ enum DeploymentIntent: string
 {
     case Deploy = 'deploy';
     case Undeploy = 'undeploy';
+
+    /**
+     * Ship the staging tree exactly as it stands, with no git work at all.
+     *
+     * The escape hatch for work that never came from a ref: a fix edited
+     * directly on staging, a hand-applied patch, a checkout someone fixed up by
+     * hand. There is nothing to select, so the deployment carries no line items
+     * — the whole tree syncs, which is also why it is gated on its own
+     * permission rather than on the per-repository deploy grants.
+     */
+    case SyncStaging = 'sync_staging';
     case VersionCreate = 'version_create';
     case VersionUndeploy = 'version_undeploy';
 
@@ -23,6 +34,7 @@ public function label(): string
         return match ($this) {
             self::Deploy => 'Deploy',
             self::Undeploy => 'Undeploy',
+            self::SyncStaging => 'Sync staging',
             self::VersionCreate => 'Create core version',
             self::VersionUndeploy => 'Undeploy core version',
         };
@@ -40,12 +52,35 @@ public function label(): string
     public function badgeTone(): string
     {
         return match ($this) {
-            self::Deploy, self::VersionCreate => 'neutral',
+            self::Deploy, self::SyncStaging, self::VersionCreate => 'neutral',
             self::Undeploy => 'warning',
             self::VersionUndeploy => 'danger',
         };
     }
 
+    /**
+     * Whether the operator picks checkouts and refs under this intent.
+     *
+     * False for a staging sync, which deploys whatever is already on disk: it
+     * carries no line items, and submitting any would imply the operator chose
+     * something that is in fact ignored.
+     */
+    public function selectsCheckouts(): bool
+    {
+        return $this !== self::SyncStaging;
+    }
+
+    /**
+     * Whether patches are meaningful under this intent.
+     *
+     * A removal has nothing left to patch, and a staging sync ships the tree as
+     * it stands — anything to be patched was patched before the sync.
+     */
+    public function carriesPatches(): bool
+    {
+        return $this !== self::Undeploy && $this !== self::SyncStaging;
+    }
+
     /**
      * Whether this intent removes things, and so needs an undeploy permission
      * rather than a deploy one.
diff --git a/app/Http/Controllers/Api/BootstrapController.php b/app/Http/Controllers/Api/BootstrapController.php
index 18d67da..b1ff621 100644
--- a/app/Http/Controllers/Api/BootstrapController.php
+++ b/app/Http/Controllers/Api/BootstrapController.php
@@ -65,6 +65,7 @@ public function payload(?User $user): array
             'can' => [
                 'deploy' => $user->can('create', Deployment::class),
                 'undeploy' => $user->hasAnyPermission(Permissions::anyUndeploy()),
+                'sync_staging' => $user->hasPermission(Permissions::DEPLOY_SYNC_STAGING),
                 'rollback' => $user->hasPermission(Permissions::DEPLOY_ROLLBACK),
                 'decide' => $user->hasPermission(Permissions::DEPLOY_DECIDE),
                 'pool' => $user->hasPermission(Permissions::DEPLOY_POOL),
diff --git a/app/Http/Controllers/Api/DeploymentWizardController.php b/app/Http/Controllers/Api/DeploymentWizardController.php
index 0ee0728..11b2b43 100644
--- a/app/Http/Controllers/Api/DeploymentWizardController.php
+++ b/app/Http/Controllers/Api/DeploymentWizardController.php
@@ -22,15 +22,17 @@
 use App\Models\Patch;
 use App\Models\Repository;
 use App\Models\RepositoryVersion;
+use App\Models\User;
 use App\Services\Deployment\DeploymentPlanner;
 use App\Services\Deployment\PlannedCall;
+use App\Services\Salt\ShimCalls;
 use App\Support\Permissions;
 use Illuminate\Http\JsonResponse;
 use Illuminate\Http\Request;
 use Illuminate\Support\Collection;
 
 /**
- * The deploy and undeploy wizards, as data.
+ * The deploy, undeploy and staging-sync wizards, as data.
  *
  * Three endpoints for one flow: what may be selected, what the selection would
  * run, and go. The middle one matters — this is a destructive multi-server action,
@@ -40,6 +42,8 @@
  */
 final class DeploymentWizardController extends Controller
 {
+    public function __construct(private readonly ShimCalls $calls) {}
+
     /**
      * Repositories, checkouts, patches and targets, filtered to what this user may
      * act on under the requested intent.
@@ -51,10 +55,20 @@ public function options(Request $request): JsonResponse
 
         if ($intent === DeploymentIntent::Undeploy) {
             abort_unless($user->hasAnyPermission(Permissions::anyUndeploy()), 403);
+        } elseif ($intent === DeploymentIntent::SyncStaging) {
+            $this->authorize('syncStaging', Deployment::class);
         } else {
             $this->authorize('create', Deployment::class);
         }
 
+        // A staging sync selects nothing, so the repository and patch lists the
+        // picker would render are not just empty — they are not asked for. The
+        // rest of the payload (targets, defaults, what this account may do) is
+        // exactly what the options step needs.
+        if ($intent === DeploymentIntent::SyncStaging) {
+            return response()->json($this->syncStagingOptions($intent, $user));
+        }
+
         $action = $intent->defaultAction();
 
         $repositories = $user->actionableRepositories(
@@ -229,6 +243,40 @@ public function store(StoreDeploymentRequest $request, CreateDeployment $create)
         ], 201);
     }
 
+    /**
+     * The options payload for a staging sync: no selection, just where it goes.
+     *
+     * @return array<string, mixed>
+     */
+    private function syncStagingOptions(DeploymentIntent $intent, User $user): array
+    {
+        return [
+            'intent' => $intent->value,
+            'intent_label' => $intent->label(),
+            'repositories' => [],
+            'types' => [],
+            'versions' => [],
+            'patches' => [],
+            'appservers' => TargetResource::collection($this->targets(TargetRole::Appserver))->resolve(),
+            'proxies' => TargetResource::collection($this->targets(TargetRole::Proxy))->resolve(),
+            'defaults' => [
+                'parallel' => (int) config('mwdeploy.rollout.default_parallel', 1),
+                'max_parallel' => (int) config('mwdeploy.rollout.max_parallel', 8),
+                'staging_only' => ! $user->hasPermission(Permissions::DEPLOY_PRODUCTION_SERVERS),
+            ],
+            'can' => [
+                'force' => $user->hasPermission(Permissions::DEPLOY_FORCE_FLAG),
+                'target_production' => $user->hasPermission(Permissions::DEPLOY_PRODUCTION_SERVERS),
+            ],
+            // What the sync will actually move, so the screen can say it without
+            // knowing the deployment's own path config.
+            'tree' => [
+                'staging' => $this->calls->stagingRoot(),
+                'production' => $this->calls->productionRoot(),
+            ],
+        ];
+    }
+
     /**
      * @return Collection<int, DeployTarget>
      */
diff --git a/app/Http/Requests/StoreDeploymentRequest.php b/app/Http/Requests/StoreDeploymentRequest.php
index 73e0354..78e53fb 100644
--- a/app/Http/Requests/StoreDeploymentRequest.php
+++ b/app/Http/Requests/StoreDeploymentRequest.php
@@ -39,9 +39,11 @@ public function authorize(): bool
             return false;
         }
 
-        return $this->intent() === DeploymentIntent::Undeploy
-            ? $user->hasAnyPermission(Permissions::anyUndeploy())
-            : $user->can('create', Deployment::class);
+        return match ($this->intent()) {
+            DeploymentIntent::Undeploy => $user->hasAnyPermission(Permissions::anyUndeploy()),
+            DeploymentIntent::SyncStaging => $user->can('syncStaging', Deployment::class),
+            default => $user->can('create', Deployment::class),
+        };
     }
 
     /**
@@ -49,12 +51,23 @@ public function authorize(): bool
      */
     public function rules(): array
     {
-        $isUndeploy = $this->intent() === DeploymentIntent::Undeploy;
+        $intent = $this->intent();
+        $isUndeploy = $intent === DeploymentIntent::Undeploy;
+        $selectsCheckouts = $intent->selectsCheckouts();
 
         return [
-            'intent' => ['sometimes', Rule::in([DeploymentIntent::Deploy->value, DeploymentIntent::Undeploy->value])],
-
-            'items' => ['required', 'array', 'min:1'],
+            'intent' => ['sometimes', Rule::in([
+                DeploymentIntent::Deploy->value,
+                DeploymentIntent::Undeploy->value,
+                DeploymentIntent::SyncStaging->value,
+            ])],
+
+            // A staging sync deploys the tree as it stands. There is nothing to
+            // select, and accepting a selection would imply the operator's choice
+            // narrowed what ships when it does not.
+            'items' => $selectsCheckouts
+                ? ['required', 'array', 'min:1']
+                : ['prohibited'],
             // Existence is checked in withValidator() against the one query that
             // already loads these models, not with a per-item `exists` rule. An
             // upgrade submits every extension in a version at once — a hundred-odd
@@ -94,6 +107,7 @@ public function messages(): array
     {
         return [
             'items.required' => 'Select at least one checkout.',
+            'items.prohibited' => 'A staging sync deploys the whole tree, so nothing is selected for it.',
             'items.*.ref_value.regex' => 'A git ref may only contain letters, digits, dots, slashes, dashes and underscores.',
             'items.*.ref_value.prohibited' => 'An undeploy has no ref to check out.',
         ];
@@ -205,6 +219,12 @@ public function action(): RepoAction
      */
     public function items(): array
     {
+        // A staging sync has no line items at all: the tree as it stands is the
+        // selection.
+        if (! $this->intent()->selectsCheckouts()) {
+            return [];
+        }
+
         $action = $this->action();
         $items = [];
 
@@ -255,9 +275,10 @@ private function submittedCheckoutIds(): array
      */
     public function patches(): Collection
     {
-        // Patches are meaningless on a removal, so they are dropped rather than
-        // validated away — the wizard does not offer them either.
-        if ($this->intent() === DeploymentIntent::Undeploy) {
+        // Patches are meaningless on a removal, and a staging sync ships whatever
+        // is already applied on disk, so they are dropped rather than validated
+        // away — the wizard does not offer them under either intent.
+        if (! $this->intent()->carriesPatches()) {
             return Patch::query()->whereRaw('1 = 0')->get();
         }
 
diff --git a/app/Models/Deployment.php b/app/Models/Deployment.php
index 36085f5..26114d7 100644
--- a/app/Models/Deployment.php
+++ b/app/Models/Deployment.php
@@ -194,6 +194,12 @@ public function summary(): string
             return 'Undeployed '.($this->mediawikiVersion?->version ?? 'a core version');
         }
 
+        // No line items by design: what shipped was whatever the staging tree
+        // held, so naming the tree is the only honest summary.
+        if ($this->intent === DeploymentIntent::SyncStaging) {
+            return 'Synced '.rtrim((string) config('mwdeploy.paths.staging'), '/').' as it stood';
+        }
+
         return $this->repoRefs->map(fn (DeploymentRepoRef $ref) => $ref->summary())->implode(', ') ?: '—';
     }
 }
diff --git a/app/Policies/DeploymentPolicy.php b/app/Policies/DeploymentPolicy.php
index fb08bd0..86fa485 100644
--- a/app/Policies/DeploymentPolicy.php
+++ b/app/Policies/DeploymentPolicy.php
@@ -39,6 +39,17 @@ public function create(User $user): bool
         ]);
     }
 
+    /**
+     * Deploying the staging tree as it stands, with nothing selected.
+     *
+     * Not implied by create: the per-repository deploy grants say which checkouts
+     * someone may push, and this pushes all of them at once.
+     */
+    public function syncStaging(User $user): bool
+    {
+        return $user->hasPermission(Permissions::DEPLOY_SYNC_STAGING);
+    }
+
     /**
      * Deliberately broader than create: when something is broken you want
      * whoever noticed to be able to revert, not to wait for an approver.
diff --git a/app/Services/Deployment/DeploymentAuthorizer.php b/app/Services/Deployment/DeploymentAuthorizer.php
index db839ed..8f814f4 100644
--- a/app/Services/Deployment/DeploymentAuthorizer.php
+++ b/app/Services/Deployment/DeploymentAuthorizer.php
@@ -59,6 +59,13 @@ public function violationFor(Deployment $deployment): ?string
             return $this->denied($actor, Permissions::VERSIONS_MANAGE);
         }
 
+        // Shipping the staging tree as it stands is not scoped to a repository,
+        // so the per-checkout grants below cannot stand in for it.
+        if ($deployment->intent === DeploymentIntent::SyncStaging
+            && ! $actor->hasPermission(Permissions::DEPLOY_SYNC_STAGING)) {
+            return $this->denied($actor, Permissions::DEPLOY_SYNC_STAGING);
+        }
+
         if (($violation = $this->checkLineItems($deployment, $actor)) !== null) {
             return $violation;
         }
diff --git a/app/Services/Deployment/DeploymentPlanner.php b/app/Services/Deployment/DeploymentPlanner.php
index 23f2f81..e2a14b8 100644
--- a/app/Services/Deployment/DeploymentPlanner.php
+++ b/app/Services/Deployment/DeploymentPlanner.php
@@ -86,7 +86,7 @@ public function plan(
             $planned[] = new PlannedCall('Preparation', $this->calls->patchApply($patch));
         }
 
-        $syncPlan = $this->calls->syncPlanFor($refs);
+        $syncPlan = $this->calls->syncPlanFor($refs, $intent);
 
         if ($syncPlan->required) {
             $planned[] = new PlannedCall('Preparation', $this->calls->rsyncLocal($syncPlan));
diff --git a/app/Services/Deployment/DeploymentRunner.php b/app/Services/Deployment/DeploymentRunner.php
index ccd66cf..1b605a3 100644
--- a/app/Services/Deployment/DeploymentRunner.php
+++ b/app/Services/Deployment/DeploymentRunner.php
@@ -33,9 +33,11 @@
  * The orchestrator. Laravel is the brain here: it sequences, retries, aborts and
  * records. Salt is a dumb remote-exec transport, one call per step per server.
  *
- * Every intent — deploy, undeploy, create a core version, remove a core version,
- * roll any of those back — runs through this one pipeline. What differs between
- * them is the line items in deployment_repo_refs, not the control flow.
+ * Every intent — deploy, undeploy, sync the staging tree as it stands, create a
+ * core version, remove a core version, roll any of those back — runs through this
+ * one pipeline. What differs between them is the line items in
+ * deployment_repo_refs, not the control flow: a staging sync simply has none, so
+ * the preparation steps fall away and the rsync covers the whole tree.
  */
 final class DeploymentRunner
 {
@@ -108,7 +110,7 @@ private function execute(Deployment $deployment): void
         }
 
         $removals = $this->removalPlanFor($deployment);
-        $syncPlan = $this->calls->syncPlanFor($refs);
+        $syncPlan = $this->calls->syncPlanFor($refs, $deployment->intent);
 
         // Removals on staging, then the checkouts that are being deployed.
         if (! $this->applyStagingRemovals($deployment, $removals)) {
diff --git a/app/Services/Salt/ShimCalls.php b/app/Services/Salt/ShimCalls.php
index 64eb193..51590a5 100644
--- a/app/Services/Salt/ShimCalls.php
+++ b/app/Services/Salt/ShimCalls.php
@@ -4,6 +4,7 @@
 
 namespace App\Services\Salt;
 
+use App\Enums\DeploymentIntent;
 use App\Enums\RepoAction;
 use App\Enums\RepositoryType;
 use App\Enums\StepName;
@@ -445,10 +446,18 @@ public function haproxy(StepName $step, DeployTarget $proxy, DeployTarget $serve
      * that only removes things syncs nothing at all rather than walking the whole
      * tree.
      *
+     * A staging sync is the one intent that says "everything" outright: it has no
+     * line items to derive paths from, because the tree as it stands *is* the
+     * selection.
+     *
      * @param  iterable<DeploymentRepoRef>  $refs
      */
-    public function syncPlanFor(iterable $refs): SyncPlan
+    public function syncPlanFor(iterable $refs, ?DeploymentIntent $intent = null): SyncPlan
     {
+        if ($intent === DeploymentIntent::SyncStaging) {
+            return SyncPlan::fullTree();
+        }
+
         $paths = [];
 
         foreach ($refs as $ref) {
diff --git a/app/Support/Permissions.php b/app/Support/Permissions.php
index eccd4d0..c83cb71 100644
--- a/app/Support/Permissions.php
+++ b/app/Support/Permissions.php
@@ -58,6 +58,15 @@ final class Permissions
 
     public const DEPLOY_PRODUCTION_SERVERS = 'deploy.production_servers';
 
+    /**
+     * Deploy the staging tree as it stands, without selecting checkouts.
+     *
+     * Its own grant because it is not scoped to a repository: it ships whatever
+     * happens to be on staging — including someone else's half-finished work —
+     * so being trusted with one extension is not enough to authorise it.
+     */
+    public const DEPLOY_SYNC_STAGING = 'deploy.sync_staging';
+
     public const DEPLOY_FORCE_FLAG = 'deploy.force_flag';
 
     public const DEPLOY_ROLLBACK = 'deploy.rollback';
@@ -118,6 +127,7 @@ public static function groups(): array
                 self::DEPLOY_SKIN,
                 self::DEPLOY_CONFIG,
                 self::DEPLOY_PRODUCTION_SERVERS,
+                self::DEPLOY_SYNC_STAGING,
                 self::DEPLOY_FORCE_FLAG,
                 self::DEPLOY_ROLLBACK,
                 self::DEPLOY_DECIDE,
@@ -166,6 +176,7 @@ public static function all(): array
             self::DEPLOY_SKIN => 'Deploy skins',
             self::DEPLOY_CONFIG => 'Deploy wiki config',
             self::DEPLOY_PRODUCTION_SERVERS => 'Target production appservers (rather than staging-only dry runs)',
+            self::DEPLOY_SYNC_STAGING => 'Deploy the staging tree as it stands, without selecting checkouts',
             self::DEPLOY_FORCE_FLAG => 'Set --force, skipping the canary gate',
             self::DEPLOY_ROLLBACK => 'Roll back a past deployment',
             self::DEPLOY_DECIDE => 'Answer a blocking canary-failure prompt on a running deployment',
diff --git a/database/seeders/RolesAndPermissionsSeeder.php b/database/seeders/RolesAndPermissionsSeeder.php
index 8ed69f8..68275b8 100644
--- a/database/seeders/RolesAndPermissionsSeeder.php
+++ b/database/seeders/RolesAndPermissionsSeeder.php
@@ -32,8 +32,8 @@ final class RolesAndPermissionsSeeder extends Seeder
             'permissions' => [
                 P::DEPLOYMENTS_ACCESS,
                 P::DEPLOY_CORE, P::DEPLOY_EXTENSION, P::DEPLOY_SKIN, P::DEPLOY_CONFIG,
-                P::DEPLOY_PRODUCTION_SERVERS, P::DEPLOY_FORCE_FLAG, P::DEPLOY_ROLLBACK,
-                P::DEPLOY_DECIDE, P::DEPLOY_POOL, P::DEPLOY_FORCE_FAIL,
+                P::DEPLOY_PRODUCTION_SERVERS, P::DEPLOY_SYNC_STAGING, P::DEPLOY_FORCE_FLAG,
+                P::DEPLOY_ROLLBACK, P::DEPLOY_DECIDE, P::DEPLOY_POOL, P::DEPLOY_FORCE_FAIL,
                 P::UNDEPLOY_EXTENSION, P::UNDEPLOY_SKIN, P::UNDEPLOY_CONFIG, P::UNDEPLOY_VERSION,
                 P::VERSIONS_MANAGE, P::REPOSITORIES_MANAGE, P::PATCHES_MANAGE,
                 P::TARGETS_MANAGE, P::USERS_MANAGE, P::ROLES_MANAGE,
@@ -44,7 +44,8 @@ final class RolesAndPermissionsSeeder extends Seeder
             'permissions' => [
                 P::DEPLOYMENTS_ACCESS,
                 P::DEPLOY_CORE, P::DEPLOY_EXTENSION, P::DEPLOY_SKIN, P::DEPLOY_CONFIG,
-                P::DEPLOY_PRODUCTION_SERVERS, P::DEPLOY_ROLLBACK, P::DEPLOY_DECIDE, P::DEPLOY_POOL,
+                P::DEPLOY_PRODUCTION_SERVERS, P::DEPLOY_SYNC_STAGING, P::DEPLOY_ROLLBACK,
+                P::DEPLOY_DECIDE, P::DEPLOY_POOL,
                 P::UNDEPLOY_EXTENSION, P::UNDEPLOY_SKIN,
                 P::VERSIONS_MANAGE, P::REPOSITORIES_MANAGE, P::DEPLOY_FORCE_FLAG,
             ],
diff --git a/resources/js/apps/deployments/components/DeployOptions.vue b/resources/js/apps/deployments/components/DeployOptions.vue
index c2a5a76..6bf135c 100644
--- a/resources/js/apps/deployments/components/DeployOptions.vue
+++ b/resources/js/apps/deployments/components/DeployOptions.vue
@@ -2,9 +2,9 @@
 import { computed } from 'vue';
 
 /**
- * Target and rollout options, shared by the deploy and undeploy wizards. These are
- * the CLI's --servers / --parallel / --rollout / --l10n / --force, with the same
- * meanings.
+ * Target and rollout options, shared by the deploy, undeploy and staging-sync
+ * wizards. These are the CLI's --servers / --parallel / --rollout / --l10n /
+ * --force, with the same meanings.
  */
 const props = defineProps({
     /** { stagingOnly, allServers, servers[], rollout, l10n, force, parallel } */
@@ -19,6 +19,7 @@ const props = defineProps({
 const emit = defineEmits(['update:modelValue']);
 
 const isUndeploy = computed(() => props.intent === 'undeploy');
+const isSyncStaging = computed(() => props.intent === 'sync_staging');
 
 const set = (changes) => emit('update:modelValue', { ...props.modelValue, ...changes });
 
@@ -47,6 +48,10 @@ const toggleServer = (hostname) => {
                     <template v-if="isUndeploy">
                         Remove from the staging tree only, leaving the appservers untouched.
                     </template>
+                    <template v-else-if="isSyncStaging">
+                        Update the production tree on the staging host and run its canary, leaving the
+                        appservers untouched.
+                    </template>
                     <template v-else>
                         Prepare and validate on staging without touching any appserver.
                     </template>
diff --git a/resources/js/apps/deployments/manifest.js b/resources/js/apps/deployments/manifest.js
index 805cac9..174ff25 100644
--- a/resources/js/apps/deployments/manifest.js
+++ b/resources/js/apps/deployments/manifest.js
@@ -33,9 +33,10 @@ export const deploymentsApp = {
         { to: at('/scoping'), label: 'Repository access', requires: 'manage_users' },
     ],
 
-    /** The two things you come here to do, so they stay one click away. */
+    /** The things you come here to do, so they stay one click away. */
     actions: [
         { to: at('/undeploy'), label: 'Undeploy', requires: 'undeploy', variant: 'secondary' },
+        { to: at('/sync'), label: 'Sync staging', requires: 'sync_staging', variant: 'secondary' },
         { to: at('/new'), label: 'New deployment', requires: 'deploy', variant: 'primary' },
     ],
 
@@ -68,6 +69,16 @@ export const deploymentsApp = {
             props: { intent: 'undeploy' },
             meta: { requires: 'undeploy' },
         },
+        // Its own route for the same reason undeploy has one: shipping whatever
+        // staging currently holds is not a variant of picking refs, and should not
+        // be one mis-click away from it.
+        {
+            path: at('/sync'),
+            name: 'deployments.sync-staging',
+            component: () => import('./pages/DeployWizardPage.vue'),
+            props: { intent: 'sync_staging' },
+            meta: { requires: 'sync_staging' },
+        },
 
         { path: at('/versions'), name: 'deployments.versions', component: () => import('./pages/VersionsPage.vue') },
         {
diff --git a/resources/js/apps/deployments/pages/DeployWizardPage.vue b/resources/js/apps/deployments/pages/DeployWizardPage.vue
index 5439b3e..0335dc9 100644
--- a/resources/js/apps/deployments/pages/DeployWizardPage.vue
+++ b/resources/js/apps/deployments/pages/DeployWizardPage.vue
@@ -14,12 +14,15 @@ import PlanReview from '../components/PlanReview.vue';
 import { flash, flashError, session } from '../../../store';
 
 /**
- * The deploy and undeploy wizards. One component, two intents — but deliberately
- * two routes: removing checkouts off the whole fleet should not be one mis-click
- * away from updating them, so there is no mode toggle here.
+ * The deploy, undeploy and staging-sync wizards. One component, three intents —
+ * but deliberately three routes: removing checkouts off the whole fleet, or
+ * shipping whatever staging currently holds, should not be one mis-click away
+ * from updating a ref, so there is no mode toggle here.
  *
- * Three steps: pick, set options, review. The review step is not decoration — it
- * shows the exact `salt` calls that will run, built by the server's planner.
+ * Three steps: pick, set options, review. A staging sync has nothing to pick, so
+ * it drops that step rather than showing an empty picker. The review step is not
+ * decoration — it shows the exact `salt` calls that will run, built by the
+ * server's planner.
  */
 const props = defineProps({
     intent: { type: String, default: 'deploy' },
@@ -49,6 +52,7 @@ const settings = ref({
 });
 
 const isUndeploy = computed(() => props.intent === 'undeploy');
+const isSyncStaging = computed(() => props.intent === 'sync_staging');
 
 /**
  * The three steps and where you are in them.
@@ -58,10 +62,13 @@ const isUndeploy = computed(() => props.intent === 'undeploy');
  * the actual consequence. A generic "Continue" on one step and a specific "Review
  * the plan" on the next makes them look like different kinds of control.
  */
-const STEP_ORDER = ['pick', 'options', 'review'];
+const STEP_ORDER = computed(() => (isSyncStaging.value ? ['options', 'review'] : ['pick', 'options', 'review']));
 
 const STEP_LABELS = { pick: 'Select', options: 'Where it goes', review: 'Review' };
 
+/** Where a staging sync starts, since there is nothing to select first. */
+const firstStep = computed(() => STEP_ORDER.value[0]);
+
 /** What the final button says, which is the consequence and not "Confirm". */
 const confirmLabel = computed(() => {
     if (plan.value?.removes_anything) {
@@ -69,18 +76,20 @@ const confirmLabel = computed(() => {
     }
 
     if (settings.value?.stagingOnly) {
-        return 'Deploy to staging';
+        return isSyncStaging.value ? 'Sync the production tree on staging' : 'Deploy to staging';
     }
 
-    return `Deploy to ${
-        settings.value?.allServers ? 'all appservers' : pluralise(settings.value?.servers.length ?? 0, 'appserver')
-    }`;
+    const where = settings.value?.allServers
+        ? 'all appservers'
+        : pluralise(settings.value?.servers.length ?? 0, 'appserver');
+
+    return isSyncStaging.value ? `Sync staging to ${where}` : `Deploy to ${where}`;
 });
 
 const steps = computed(() => {
-    const at = STEP_ORDER.indexOf(step.value);
+    const at = STEP_ORDER.value.indexOf(step.value);
 
-    return STEP_ORDER.map((key, index) => ({
+    return STEP_ORDER.value.map((key, index) => ({
         key,
         label: STEP_LABELS[key],
         state: index < at ? 'done' : index === at ? 'current' : 'upcoming',
@@ -91,6 +100,7 @@ const selectedIds = computed(() => Object.keys(selection.value).map(Number));
 
 const load = async () => {
     loading.value = true;
+    step.value = firstStep.value;
 
     try {
         options.value = await api.get(endpoint('deployments/wizard'), {
@@ -123,7 +133,6 @@ watch(
         selection.value = {};
         patchIds.value = [];
         plan.value = null;
-        step.value = 'pick';
         load();
     },
 );
@@ -133,7 +142,7 @@ watch(
  * so nobody retypes a patch target; pre-selecting them is the other half of that.
  */
 const relevantPatches = computed(() => {
-    if (isUndeploy.value) {
+    if (isUndeploy.value || isSyncStaging.value) {
         return [];
     }
 
@@ -148,13 +157,17 @@ watch(relevantPatches, (patches) => {
 
 const payload = () => ({
     intent: props.intent,
-    items: Object.entries(selection.value).map(([id, choice]) => ({
-        repository_version_id: Number(id),
-        ...(isUndeploy.value
-            ? {}
-            : { ref_type: choice.refType, ref_value: (choice.refValue ?? '').trim() }),
-    })),
-    patches: isUndeploy.value ? [] : patchIds.value,
+    // A staging sync selects nothing: the tree as it stands is what ships, and the
+    // server refuses items under this intent rather than quietly ignoring them.
+    items: isSyncStaging.value
+        ? []
+        : Object.entries(selection.value).map(([id, choice]) => ({
+              repository_version_id: Number(id),
+              ...(isUndeploy.value
+                  ? {}
+                  : { ref_type: choice.refType, ref_value: (choice.refValue ?? '').trim() }),
+          })),
+    patches: isUndeploy.value || isSyncStaging.value ? [] : patchIds.value,
     servers: settings.value.stagingOnly || settings.value.allServers ? [] : settings.value.servers,
     parallel: settings.value.stagingOnly ? 1 : settings.value.parallel,
     force: settings.value.force,
@@ -194,7 +207,7 @@ const confirm = async () => {
     } catch (thrown) {
         if (thrown instanceof ApiError && thrown.isValidation) {
             validation.value = thrown.all();
-            step.value = 'pick';
+            step.value = firstStep.value;
         } else {
             flashError(thrown);
         }
@@ -209,7 +222,13 @@ const confirm = async () => {
         <div v-if="options" class="space-y-6">
             <header>
                 <h1 class="text-xl font-semibold">
-                    {{ isUndeploy ? 'Undeploy from the fleet' : 'New deployment' }}
+                    {{
+                        isUndeploy
+                            ? 'Undeploy from the fleet'
+                            : isSyncStaging
+                              ? 'Sync staging as it stands'
+                              : 'New deployment'
+                    }}
                 </h1>
                 <p class="mt-1.5 max-w-prose text-sm text-pretty text-fg-muted">
                     <template v-if="isUndeploy">
@@ -217,6 +236,12 @@ const confirm = async () => {
                         <code class="font-mono">rm -rf</code> per host. Reversible: rolling the removal back
                         clones them again at the ref they were on.
                     </template>
+                    <template v-else-if="isSyncStaging">
+                        Ships <code class="font-mono">{{ options.tree?.staging }}</code> exactly as it is right
+                        now — no fetch, no checkout, nothing selected. For fixes made directly on staging: a
+                        hand-edited file, a patch applied by hand, a checkout someone repaired in place. Because
+                        no ref is recorded, there is no undo point, and rollback is not offered afterwards.
+                    </template>
                     <template v-else>
                         Pick checkouts and refs, choose where it goes, then review every Salt call before it runs.
                     </template>
@@ -266,7 +291,7 @@ const confirm = async () => {
                 </ul>
             </div>
 
-            <template v-if="step === 'pick'">
+            <template v-if="step === 'pick' && !isSyncStaging">
                 <CardPanel
                     title="What to deploy"
                     :subtitle="
@@ -327,6 +352,27 @@ const confirm = async () => {
             </template>
 
             <template v-else-if="step === 'options'">
+                <CardPanel
+                    v-if="isSyncStaging"
+                    title="What will be synced"
+                    subtitle="The whole tree, as it stands on disk."
+                >
+                    <dl class="grid gap-3 text-sm sm:grid-cols-2">
+                        <div>
+                            <dt class="text-xs font-medium text-fg-subtle">From</dt>
+                            <dd class="mt-0.5 font-mono text-xs">{{ options.tree?.staging }}</dd>
+                        </div>
+                        <div>
+                            <dt class="text-xs font-medium text-fg-subtle">To</dt>
+                            <dd class="mt-0.5 font-mono text-xs">{{ options.tree?.production }}</dd>
+                        </div>
+                    </dl>
+                    <p class="mt-3 text-xs text-fg-subtle">
+                        Whatever is on staging goes out, including anything staged by someone else since it was
+                        last deployed. Check the tree before continuing.
+                    </p>
+                </CardPanel>
+
                 <CardPanel title="Where it goes">
                     <DeployOptions
                         v-model="settings"
@@ -338,8 +384,15 @@ const confirm = async () => {
                     />
                 </CardPanel>
 
-                <div class="flex flex-wrap items-center justify-between gap-3">
-                    <AppButton variant="ghost" icon="arrow-left" @click="step = 'pick'">Back to selection</AppButton>
+                <!-- A staging sync has no selection step, so there is nothing to
+                     go back to and the one button sits on its own. -->
+                <div
+                    class="flex flex-wrap items-center gap-3"
+                    :class="isSyncStaging ? 'justify-end' : 'justify-between'"
+                >
+                    <AppButton v-if="!isSyncStaging" variant="ghost" icon="arrow-left" @click="step = 'pick'">
+                        Back to selection
+                    </AppButton>
                     <AppButton
                         variant="primary"
                         trailing-icon="chevron-right"
diff --git a/resources/js/apps/deployments/pages/DeploymentShowPage.vue b/resources/js/apps/deployments/pages/DeploymentShowPage.vue
index 902f97c..5bb7afc 100644
--- a/resources/js/apps/deployments/pages/DeploymentShowPage.vue
+++ b/resources/js/apps/deployments/pages/DeploymentShowPage.vue
@@ -383,6 +383,11 @@ const forceFail = async () => {
                             <span v-if="item.version" class="text-fg-subtle">({{ item.version }})</span>
                             <code class="ms-auto font-mono text-xs">{{ item.short_ref }}</code>
                         </li>
+                        <!-- A staging sync has none by design, so say what shipped
+                             instead of leaving the heading over an empty list. -->
+                        <li v-if="!deployment.refs?.length" class="py-1.5 text-fg-subtle">
+                            {{ deployment.summary }}
+                        </li>
                     </ul>
 
                     <div v-if="deployment.patches?.length" class="mt-4">
diff --git a/tests/Feature/SyncStagingTest.php b/tests/Feature/SyncStagingTest.php
new file mode 100644
index 0000000..283831c
--- /dev/null
+++ b/tests/Feature/SyncStagingTest.php
@@ -0,0 +1,334 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Tests\Feature;
+
+use App\Enums\DeploymentDecision;
+use App\Enums\DeploymentIntent;
+use App\Enums\DeploymentStatus;
+use App\Enums\StepName;
+use App\Jobs\RunDeployment;
+use App\Models\Deployment;
+use App\Models\DeployTarget;
+use App\Models\User;
+use App\Services\Deployment\DeploymentAuthorizer;
+use App\Services\Deployment\DeploymentRunner;
+use App\Services\Salt\Testing\FakeSaltClient;
+use App\Support\DeploymentOptions;
+use App\Support\Permissions;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Illuminate\Support\Facades\Queue;
+use PHPUnit\Framework\Attributes\Test;
+use Tests\Support\AutoAnsweringDecisionGate;
+use Tests\TestCase;
+
+/**
+ * Deploying the staging tree exactly as it stands: no fetch, no checkout, nothing
+ * selected.
+ *
+ * The escape hatch for work that never came from a ref — a file edited directly on
+ * staging, a patch applied by hand — so the interesting assertions are all about
+ * what it does *not* do to the tree on the way out.
+ */
+final class SyncStagingTest extends TestCase
+{
+    use RefreshDatabase;
+
+    private FakeSaltClient $salt;
+
+    private AutoAnsweringDecisionGate $decisions;
+
+    private User $actor;
+
+    protected function setUp(): void
+    {
+        parent::setUp();
+
+        config([
+            'mwdeploy.targets.staging' => 'staging',
+            'mwdeploy.shim.binary' => '/usr/local/bin/mwdeploy-shim',
+            'mwdeploy.paths.staging' => '/srv/mediawiki-staging',
+            'mwdeploy.paths.production' => '/srv/mediawiki',
+            'mwdeploy.decisions.timeout' => 0,
+        ]);
+
+        Queue::fake();
+
+        $this->salt = $this->fakeSalt();
+        $this->decisions = $this->fakeDecisions();
+        $this->actor = $this->admin();
+    }
+
+    #[Test]
+    public function it_syncs_the_whole_tree_to_production_and_every_appserver(): void
+    {
+        DeployTarget::factory()->create(['hostname' => 'mw-01']);
+        DeployTarget::factory()->create(['hostname' => 'mw-02']);
+
+        $deployment = $this->syncDeployment(new DeploymentOptions(parallel: 2));
+
+        $this->runJob($deployment);
+
+        $this->assertSame(DeploymentStatus::Done, $deployment->fresh()->status);
+
+        $local = $this->salt->callsFor(StepName::RsyncLocal);
+
+        $this->assertCount(1, $local);
+        $this->assertStringContainsString("'--src' '/srv/mediawiki-staging/'", $local[0]->command->toString());
+        $this->assertStringContainsString("'--dst' '/srv/mediawiki/'", $local[0]->command->toString());
+
+        // No --path anywhere: an empty path list is how both rsync verbs are told
+        // "the whole tree", and a staging sync is the intent that means it.
+        foreach ([...$local, ...$this->salt->callsFor(StepName::RsyncRemote)] as $call) {
+            $this->assertStringNotContainsString("'--path'", $call->command->toString());
+        }
+
+        $this->salt->assertRan(StepName::RsyncRemote, 'mw-01');
+        $this->salt->assertRan(StepName::RsyncRemote, 'mw-02');
+    }
+
+    #[Test]
+    public function it_never_touches_git_on_the_way_out(): void
+    {
+        DeployTarget::factory()->create();
+
+        // Present checkouts exist; the point is that a sync ignores them rather
+        // than fetching or resetting anything.
+        $this->extension('Echo', $this->version('1.45'));
+
+        $this->runJob($this->syncDeployment());
+
+        $this->salt->assertNeverRan(StepName::GitFetch);
+        $this->salt->assertNeverRan(StepName::GitPull);
+        $this->salt->assertNeverRan(StepName::GitCheckout);
+        $this->salt->assertNeverRan(StepName::GitHead);
+        $this->salt->assertNeverRan(StepName::RepoRegister);
+        $this->salt->assertNeverRan(StepName::RepoRemove);
+        $this->salt->assertNeverRan(StepName::PatchApply);
+    }
+
+    #[Test]
+    public function the_staging_canary_still_gates_the_rollout(): void
+    {
+        DeployTarget::factory()->create(['hostname' => 'mw-01']);
+
+        $this->salt->alwaysRespondTo(StepName::Canary, false);
+        // The gate genuinely blocks on a real operator; this is one clicking abort.
+        $this->decisions->answerWith(DeploymentDecision::Abort);
+
+        $deployment = $this->syncDeployment();
+
+        $this->runJob($deployment);
+
+        $this->assertSame(DeploymentStatus::Failed, $deployment->fresh()->status);
+        $this->assertStringContainsString('staging canary failed', (string) $deployment->fresh()->failure_reason);
+        // Never reached an appserver: the gate is the same one every other intent
+        // passes through.
+        $this->salt->assertNeverRan(StepName::RsyncRemote);
+    }
+
+    #[Test]
+    public function a_staging_only_sync_updates_the_production_tree_on_staging_and_stops(): void
+    {
+        DeployTarget::factory()->create(['hostname' => 'mw-01']);
+
+        $deployment = $this->syncDeployment(new DeploymentOptions(stagingOnly: true));
+
+        $this->runJob($deployment);
+
+        $this->assertSame(DeploymentStatus::Done, $deployment->fresh()->status);
+        $this->salt->assertRan(StepName::RsyncLocal, 'staging');
+        $this->salt->assertNeverRan(StepName::RsyncRemote);
+    }
+
+    #[Test]
+    public function a_failed_sync_enqueues_no_rollback_because_staging_was_never_mutated(): void
+    {
+        DeployTarget::factory()->create(['hostname' => 'mw-01']);
+
+        $this->salt->alwaysRespondTo(StepName::RsyncLocal, false);
+
+        $deployment = $this->syncDeployment();
+
+        $this->runJob($deployment);
+
+        $this->assertSame(DeploymentStatus::Failed, $deployment->fresh()->status);
+        // There is no undo point to roll back to — nothing about the staging tree
+        // was changed by this deployment, so the tree it shipped is still there.
+        $this->assertSame(1, Deployment::query()->count());
+    }
+
+    #[Test]
+    public function the_history_row_says_which_tree_was_shipped(): void
+    {
+        $deployment = $this->syncDeployment();
+
+        $this->assertSame('Synced /srv/mediawiki-staging as it stood', $deployment->summary());
+    }
+
+    /*
+     * ----------------------------------------------------------------------- *
+     * The wizard endpoints
+     * ----------------------------------------------------------------------- *
+     */
+
+    #[Test]
+    public function the_wizard_offers_no_selection_and_names_both_trees(): void
+    {
+        $response = $this->actingAs($this->syncer())
+            ->getJson(route('api.deployments.wizard', ['intent' => 'sync_staging']));
+
+        $response->assertOk();
+
+        $this->assertSame('sync_staging', $response->json('intent'));
+        $this->assertSame([], $response->json('repositories'));
+        $this->assertSame([], $response->json('patches'));
+        $this->assertSame('/srv/mediawiki-staging', $response->json('tree.staging'));
+        $this->assertSame('/srv/mediawiki', $response->json('tree.production'));
+    }
+
+    #[Test]
+    public function the_plan_is_an_rsync_of_the_whole_tree_with_no_preparation_steps(): void
+    {
+        DeployTarget::factory()->create(['hostname' => 'mw-01']);
+        $this->extension('Echo', $this->version('1.45'));
+
+        $response = $this->actingAs($this->syncer())
+            ->postJson(route('api.deployments.plan'), [
+                'intent' => 'sync_staging',
+                'items' => [],
+                'parallel' => 1,
+            ]);
+
+        $response->assertOk();
+
+        $steps = collect($response->json('phases'))->flatten(1)->pluck('step')->all();
+
+        $this->assertSame([
+            StepName::RsyncLocal->value,
+            StepName::Canary->value,
+            StepName::RsyncRemote->value,
+            StepName::Canary->value,
+        ], $steps);
+
+        $this->assertSame([], $response->json('items'));
+        $this->assertFalse($response->json('removes_anything'));
+    }
+
+    #[Test]
+    public function submitting_it_stores_a_deployment_with_no_line_items(): void
+    {
+        DeployTarget::factory()->create(['hostname' => 'mw-01']);
+
+        $this->actingAs($this->syncer())
+            ->postJson(route('api.deployments.store'), [
+                'intent' => 'sync_staging',
+                'items' => [],
+                'parallel' => 1,
+            ])
+            ->assertCreated();
+
+        $deployment = Deployment::query()->latest('id')->firstOrFail();
+
+        $this->assertSame(DeploymentIntent::SyncStaging, $deployment->intent);
+        $this->assertSame(0, $deployment->repoRefs()->count());
+
+        Queue::assertPushed(RunDeployment::class);
+    }
+
+    #[Test]
+    public function selecting_checkouts_under_a_sync_is_refused_rather_than_ignored(): void
+    {
+        $echo = $this->extension('Echo', $this->version('1.45'));
+
+        $this->actingAs($this->syncer())
+            ->postJson(route('api.deployments.store'), [
+                'intent' => 'sync_staging',
+                'items' => [
+                    ['repository_version_id' => $echo->getKey(), 'ref_value' => 'REL1_45'],
+                ],
+                'parallel' => 1,
+            ])
+            ->assertJsonValidationErrors('items');
+
+        $this->assertSame(0, Deployment::query()->count());
+    }
+
+    /*
+     * ----------------------------------------------------------------------- *
+     * Permissions
+     * ----------------------------------------------------------------------- *
+     */
+
+    #[Test]
+    public function every_deploy_permission_short_of_the_sync_grant_is_not_enough(): void
+    {
+        $deployer = $this->userWithPermissions([
+            Permissions::DEPLOY_CORE,
+            Permissions::DEPLOY_EXTENSION,
+            Permissions::DEPLOY_SKIN,
+            Permissions::DEPLOY_CONFIG,
+            Permissions::DEPLOY_PRODUCTION_SERVERS,
+        ]);
+
+        $this->actingAs($deployer)
+            ->getJson(route('api.deployments.wizard', ['intent' => 'sync_staging']))
+            ->assertForbidden();
+
+        $this->actingAs($deployer)
+            ->postJson(route('api.deployments.store'), [
+                'intent' => 'sync_staging',
+                'items' => [],
+                'parallel' => 1,
+            ])
+            ->assertForbidden();
+
+        $this->assertSame(0, Deployment::query()->count());
+    }
+
+    #[Test]
+    public function the_job_refuses_a_sync_whose_creator_lacks_the_grant(): void
+    {
+        DeployTarget::factory()->create(['hostname' => 'mw-01']);
+
+        $deployment = Deployment::factory()->intent(DeploymentIntent::SyncStaging)->create([
+            'created_by' => $this->userWithPermissions([
+                Permissions::DEPLOY_EXTENSION,
+                Permissions::DEPLOY_PRODUCTION_SERVERS,
+            ])->getKey(),
+            'options' => (new DeploymentOptions)->toArray(),
+        ]);
+
+        $this->runJob($deployment->fresh());
+
+        $this->assertSame(DeploymentStatus::Failed, $deployment->fresh()->status);
+        $this->assertStringContainsString(Permissions::DEPLOY_SYNC_STAGING, (string) $deployment->fresh()->failure_reason);
+        // Refused before anything left the portal.
+        $this->salt->assertNeverRan(StepName::RsyncLocal);
+    }
+
+    private function syncer(): User
+    {
+        return $this->userWithPermissions([
+            Permissions::DEPLOY_SYNC_STAGING,
+            Permissions::DEPLOY_PRODUCTION_SERVERS,
+        ]);
+    }
+
+    private function syncDeployment(?DeploymentOptions $options = null): Deployment
+    {
+        return Deployment::factory()->intent(DeploymentIntent::SyncStaging)->create([
+            'created_by' => $this->actor->getKey(),
+            'options' => ($options ?? new DeploymentOptions)->toArray(),
+        ])->fresh();
+    }
+
+    private function runJob(Deployment $deployment): void
+    {
+        (new RunDeployment($deployment->getKey()))->handle(
+            app(DeploymentRunner::class),
+            app(DeploymentAuthorizer::class),
+        );
+    }
+}