diff --git a/scripts/deploy-server.sh b/scripts/deploy-server.sh
index 7419531..b00f81b 100755
--- a/scripts/deploy-server.sh
+++ b/scripts/deploy-server.sh
@@ -2,14 +2,30 @@
 # Deploy doctate-server to a remote Docker host (default: minerva.lan).
 # Idempotent: re-runs preserve operator-owned config, data, logs.
 #
-# Usage: ./scripts/deploy-server.sh [host]
-#   host  default: minerva.lan
+# Usage: ./scripts/deploy-server.sh [--force|-f] [host]
+#   --force, -f  build even if the working tree is dirty
+#   host         default: minerva.lan
 #
 # See docs/deployment.md for first-time bootstrap.
 
 set -euo pipefail
 
-HOST="${1:-minerva.lan}"
+FORCE=0
+HOST=""
+while [[ $# -gt 0 ]]; do
+    case "$1" in
+        --force|-f) FORCE=1 ;;
+        -h|--help)
+            sed -n '2,8p' "$0" | sed 's/^# \{0,1\}//'
+            exit 0
+            ;;
+        -*) echo "Unknown flag: $1" >&2; exit 2 ;;
+        *)  HOST="$1" ;;
+    esac
+    shift
+done
+HOST="${HOST:-minerva.lan}"
+
 REMOTE="/opt/stacks/doctate-server"
 REPO_ROOT="$(cd "$(dirname "$0")/.." && pwd)"
 GIT_SHA="$(cd "$REPO_ROOT" && git rev-parse --short HEAD)"
@@ -19,13 +35,20 @@ IMAGE_TAGGED="doctate-server:$GIT_SHA"
 cd "$REPO_ROOT"
 
 # ─── Phase 0 ─── local pre-flight
+if [[ -n "$(git -C "$REPO_ROOT" status --porcelain)" ]]; then
+    if (( FORCE )); then
+        echo "    WARNING: working tree is dirty — building from on-disk state, not from $GIT_SHA (--force given)" >&2
+    else
+        echo "ERROR: working tree is dirty. Commit/stash your changes, or pass --force to deploy anyway." >&2
+        echo >&2
+        git -C "$REPO_ROOT" status --short >&2
+        exit 1
+    fi
+fi
+
 echo ">>> [0/10] cargo fmt --check (server)"
 ( cd server && cargo fmt --check )
 
-if ! git -C "$REPO_ROOT" diff --quiet || ! git -C "$REPO_ROOT" diff --cached --quiet; then
-    echo "    WARNING: working tree is dirty — building from on-disk state, not from $GIT_SHA" >&2
-fi
-
 # ─── Phase 1 ─── remote bootstrap (idempotent)
 echo ">>> [1/10] Ensuring remote layout at $HOST:$REMOTE"
 ssh "$HOST" "mkdir -p $REMOTE/config $REMOTE/data $REMOTE/logs"