diff --git a/.gitea/workflows/ssh-run.sh b/.gitea/workflows/ssh-run.sh
index b8396cb..b2d8441 100755
--- a/.gitea/workflows/ssh-run.sh
+++ b/.gitea/workflows/ssh-run.sh
@@ -53,6 +53,7 @@ for attempt in 1 2 3; do
     sleep $((attempt * 5))
   fi
   rc=0
+  # shellcheck disable=SC2029 # remote_cmd/ssh_opts expand on the client on purpose: they select the local ssh invocation, only the heredoc runs remotely.
   ssh "${ssh_opts[@]}" "${DEPLOY_USER}@${DEPLOY_HOST}" \
     env "REPO=$deploy_path" "APPLY_PRUNE=${APPLY_PRUNE:-false}" \
     "DEPLOY_SHA=${DEPLOY_SHA:-}" "DEPLOY_SNAPSHOT_DIR=${DEPLOY_SNAPSHOT_DIR:-}" \