diff --git a/content-editor.js b/content-editor.js
index 6ffb1aa..d292c4a 100644
--- a/content-editor.js
+++ b/content-editor.js
@@ -314,7 +314,11 @@ const server = http.createServer(async (req, res) => {
         const deployCmd = process.env.CONTENT_EDITOR_DEPLOY_CMD
           || `cd ../../../ && ./deploy.sh ${CMS_DEPLOY_ENV} > deploy.log 2>&1`;
         writeAudit('deploy_spawned', { clientAddress, user: CMS_USER, env: CMS_DEPLOY_ENV });
-        exec(deployCmd, { maxBuffer: 8 * 1024 * 1024 }, deployError => {
+        // WHY cwd: without it the child starts in the process working directory
+        // (repo root), where `cd ../../../` lands on "/" — no write access, so
+        // deploy.log creation failed with Permission denied and the deploy never
+        // ran. CONTENT_DIR is the same base the git publish command uses.
+        exec(deployCmd, { cwd: CONTENT_DIR, maxBuffer: 8 * 1024 * 1024 }, deployError => {
           writeAudit('deploy_exec_exit', {
             clientAddress,
             user: CMS_USER,