diff --git a/deploy/RUNBOOK.md b/deploy/RUNBOOK.md
index bf159ec..6478bc6 100644
--- a/deploy/RUNBOOK.md
+++ b/deploy/RUNBOOK.md
@@ -269,8 +269,9 @@ release.
 
 [`mealquest-auto-deploy.timer`](systemd/mealquest-auto-deploy.timer) starts
 [`mealquest-auto-deploy.service`](systemd/mealquest-auto-deploy.service)
-2 minutes after the timer starts, then 15 minutes after each run, plus up to
-5 minutes' random delay. The service runs the script as `overseer` from the
+at every quarter hour (`OnCalendar=*-*-* *:0/15:00`), plus up to 5 minutes'
+random delay; a check missed while the host was down runs as soon as it is
+back (`Persistent=true`). The service runs the script as `overseer` from the
 checkout, and only while `mealquest.service` is active: a stack stopped on
 purpose (a database or media restore) is skipped, not redeployed. Output goes
 to the journal (`journalctl -u mealquest-auto-deploy`).
diff --git a/deploy/auto-deploy.sh b/deploy/auto-deploy.sh
index e94fef9..fa4876f 100755
--- a/deploy/auto-deploy.sh
+++ b/deploy/auto-deploy.sh
@@ -51,7 +51,10 @@ git fetch --quiet --tags origin || fail "git fetch origin failed"
 if [ -n "$ref" ]; then
   target=$(git rev-parse --verify --quiet "$ref^{commit}") || fail "$ref is not a commit in $CHECKOUT"
 else
-  target=$(git rev-parse --verify origin/main)
+  # The full remote-tracking ref: a bare origin/main resolves a tag or local
+  # branch of that name first, which could deploy a commit not on main.
+  target=$(git rev-parse --verify --quiet "refs/remotes/origin/main^{commit}") \
+    || fail "refs/remotes/origin/main is not a commit in $CHECKOUT"
   [ -f "$RECORD" ] || fail "no deploy record at $RECORD: seed it with one manual deploy (deploy/RUNBOOK.md \"Automated deploys\")"
   last=$(grep -oE 'deployed=[0-9a-f]{40}' "$RECORD" | tail -n 1 | cut -d = -f 2) || true
   [ -n "$last" ] || fail "$RECORD records no deploy: seed it with one manual deploy (deploy/RUNBOOK.md \"Automated deploys\")"
diff --git a/deploy/systemd/mealquest-auto-deploy.timer b/deploy/systemd/mealquest-auto-deploy.timer
index 37064ef..864ea43 100644
--- a/deploy/systemd/mealquest-auto-deploy.timer
+++ b/deploy/systemd/mealquest-auto-deploy.timer
@@ -1,15 +1,11 @@
-# Checks for a new main every 15 minutes (plus up to 5 minutes' random
-# delay), starting 2 minutes after the timer starts. OnUnitActiveSec= alone
-# never fires before the service's first run, so OnActiveSec= starts the
-# cycle at boot and at `enable --now`. Persistent= is set as the task
-# specified; systemd applies it only to OnCalendar= triggers, so with these
-# monotonic triggers it has no effect.
+# Checks for a new main at every quarter hour (plus up to 5 minutes' random
+# delay). Persistent= runs a check at once when the host comes back if a
+# scheduled one was missed while it was down.
 [Unit]
 Description=Periodic MealQuest automated deploy
 
 [Timer]
-OnActiveSec=2min
-OnUnitActiveSec=15min
+OnCalendar=*-*-* *:0/15:00
 RandomizedDelaySec=5min
 Persistent=true