diff --git a/CHECKSUMS.txt b/CHECKSUMS.txt
index 45a73a0..4d6483f 100644
--- a/CHECKSUMS.txt
+++ b/CHECKSUMS.txt
@@ -8,7 +8,7 @@ dbd1b9c64fba16a308ffa8fa936f1bfda556b049aaa30ebe5400ca74b7e6aa5d  zbackup_ec2.ps
 e03075f367a9ecee0f97438bc381044c74b7bd4e8cb4ff66b40048bba7ffd25a  zchecksums.cmd
 8382ad5f972405678b73616f608a80e3eb1814c927ba104e446d36c4f9f5c66d  zchecksums.ps1
 3d1064817ace57fe61c54104900775a0208fdf7e782043cced84b002347acb11  zdeploy.cmd
-c7c7ee1019808356bc4bad738edcd4e851ea797e28fe367a88fcd96bc5570770  zdeploy.ps1
+c3b5eeac28cb4c17a8b74638466a7e8529af64dba79b11ad46b3d78c36b6b81f  zdeploy.ps1
 6fa05d7c47992801d0ad65095146764cc207b566dca85956b3152221ef9af368  zec2.cmd
 72217c04e8975f46b489bd7e223f9fda926d982a8e418fc2825c6aa4657f73b7  zec2.ps1
 d0702f372ec5e47e2632229c61b71a9184edf0775d6e23af74e3f919d13eadb9  zec2_rotatekeys.cmd
diff --git a/zdeploy.ps1 b/zdeploy.ps1
index bfd1362..27c2fd3 100644
--- a/zdeploy.ps1
+++ b/zdeploy.ps1
@@ -776,6 +776,30 @@ function Invoke-DockerDeploy {
         if ($LASTEXITCODE -ne 0) { throw "SCP failed for $($f.Name) (exit $LASTEXITCODE)" }
     }
 
+    # Config subdirectories ship too, exactly as the edge kind does. Uploading
+    # top-level files ONLY was silently wrong for any stack that keeps config in
+    # a directory: the compose file arrives, the containers restart, and the
+    # config they read is whatever was already on the box. That is worse than a
+    # failed deploy, because it reports success - a provisioning directory read
+    # at container start (alert rules, datasources, mounted *.php) would never
+    # reflect the change you just deployed.
+    #
+    # Skipped: $JunkDirNames (.git, __pycache__, .pytest_cache, ...) plus
+    # anything the project lists in deploy.skipDirs. That list is how a stack
+    # protects SERVER-SIDE STATE that happens to share the tree - a data/ holding
+    # mailboxes or a time-series database must never be overwritten by whatever
+    # the local checkout has (usually nothing, which is the dangerous case).
+    # .github is CI config - it belongs in the repo and never on a deploy
+    # target. It is not in $JunkDirNames because backups DO want it.
+    $skipDirs = @($script:JunkDirNames) + @('.github')
+    if ($Proj.deploy -and $Proj.deploy.skipDirs) { $skipDirs += @($Proj.deploy.skipDirs) }
+    $dirs = @(Get-ChildItem -LiteralPath $root -Directory | Where-Object { $skipDirs -notcontains $_.Name })
+    foreach ($d in $dirs) {
+        Write-Host "  >> uploading $($d.Name)/ (recursive)" -ForegroundColor DarkCyan
+        scp -r @SCP_OPTS -i $PEM_KEY $d.FullName "${SSH_TARGET}:$remotePath/"
+        if ($LASTEXITCODE -ne 0) { throw "SCP failed for $($d.Name) (exit $LASTEXITCODE)" }
+    }
+
     Invoke-Ec2Step "docker compose pull" "cd $remotePath && sudo docker compose pull"
     Invoke-Ec2Step "docker compose up -d" "cd $remotePath && sudo docker compose up -d"