diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml
index 7ec7e4a..daf778c 100644
--- a/.github/workflows/deploy.yml
+++ b/.github/workflows/deploy.yml
@@ -13,6 +13,13 @@ jobs:
     steps:
       - uses: actions/checkout@v4
 
+      - name: Set up SSH
+        run: |
+          mkdir -p ~/.ssh
+          printf '%s\n' "${{ secrets.SSH_PRIVATE_KEY }}" > ~/.ssh/id_rsa
+          chmod 600 ~/.ssh/id_rsa
+          ssh-keyscan -p 222 ${{ secrets.SSH_HOST }} >> ~/.ssh/known_hosts 2>/dev/null
+
       - name: Restore node_modules cache
         id: nm-cache
         run: |
@@ -68,11 +75,8 @@ jobs:
 
       - name: Fetch homepage config from node jail
         run: |
-          mkdir -p ~/.ssh
-          printf '%s\n' "${{ secrets.SSH_PRIVATE_KEY }}" > ~/.ssh/id_rsa
-          chmod 600 ~/.ssh/id_rsa
           mkdir -p content/.indiekit
-          ssh -p 222 -o StrictHostKeyChecking=no \
+          ssh -p 222 \
             ${{ secrets.SSH_USER }}@${{ secrets.SSH_HOST }} \
             "doas bastille cmd node cat /usr/local/indiekit/content/.indiekit/homepage.json" \
             > content/.indiekit/homepage.json
@@ -168,17 +172,26 @@ jobs:
 
       - name: Deploy via rsync
         run: |
-          mkdir -p ~/.ssh
-          printf '%s\n' "${{ secrets.SSH_PRIVATE_KEY }}" > ~/.ssh/id_rsa
-          chmod 600 ~/.ssh/id_rsa
-          ssh-keyscan -p 222 ${{ secrets.SSH_HOST }} >> ~/.ssh/known_hosts 2>/dev/null
           cp .env _site/.env
-          rsync -rlz --delete \
+          rsync -rl --delete \
             --exclude='content/.indiekit/' \
+            --exclude='og/' \
+            --exclude='fonts/' \
             -e "ssh -p 222" \
             _site/ \
             ${{ secrets.SSH_USER }}@${{ secrets.SSH_HOST }}:/usr/local/bastille/jails/web/root/usr/local/www/blog/
 
+      - name: Sync OG images and fonts
+        run: |
+          rsync -rl --ignore-existing \
+            -e "ssh -p 222" \
+            _site/og/ \
+            ${{ secrets.SSH_USER }}@${{ secrets.SSH_HOST }}:/usr/local/bastille/jails/web/root/usr/local/www/blog/og/
+          rsync -rl --ignore-existing \
+            -e "ssh -p 222" \
+            _site/fonts/ \
+            ${{ secrets.SSH_USER }}@${{ secrets.SSH_HOST }}:/usr/local/bastille/jails/web/root/usr/local/www/blog/fonts/
+
       - name: Trigger syndication webhook
         env:
           SECRET: ${{ secrets.SECRET }}