diff --git a/.gitea/workflows/deploy-nginx.yml b/.gitea/workflows/deploy-nginx.yml
index 540f092..dd5d822 100644
--- a/.gitea/workflows/deploy-nginx.yml
+++ b/.gitea/workflows/deploy-nginx.yml
@@ -17,8 +17,7 @@ jobs:
           chmod 644 ~/.ssh/known_hosts
           echo "${{ secrets.DEPLOY_SSH_KEY }}" > ~/.ssh/deploy_key
           chmod 600 ~/.ssh/deploy_key
-          cat ~/.ssh/known_hosts
-          ssh -v -o StrictHostKeyChecking=yes -i ~/.ssh/deploy_key deploy@${{ vars.DEPLOY_HOST }} deploy-nginx
+          ssh -o StrictHostKeyChecking=yes -i ~/.ssh/deploy_key deploy@${{ vars.DEPLOY_HOST }} deploy-nginx
 
   test:
     needs: deploy
diff --git a/scripts/deploy.sh b/scripts/deploy.sh
index 872da34..a87c8a7 100755
--- a/scripts/deploy.sh
+++ b/scripts/deploy.sh
@@ -90,6 +90,8 @@ if [ "$APP" = "nginx" ]; then
     missing_certs=false
     for conf in /opt/hantim/docker/nginx/conf.d/*.conf; do
         cert_name=$(basename "$conf" .conf)
+        # skip catch-all default server blocks (server_name _)
+        grep -qP 'server_name\s+_\s*;' "$conf" && continue
         if [ ! -d "/etc/letsencrypt/live/$cert_name" ]; then
             missing_certs=true
             break
@@ -100,6 +102,8 @@ if [ "$APP" = "nginx" ]; then
         trap 'docker start nginx 2>/dev/null || true' EXIT
         for conf in /opt/hantim/docker/nginx/conf.d/*.conf; do
             cert_name=$(basename "$conf" .conf)
+            # skip catch-all default server blocks (server_name _)
+            grep -qP 'server_name\s+_\s*;' "$conf" && continue
             if [ ! -d "/etc/letsencrypt/live/$cert_name" ]; then
                 domains=$(grep -oP 'server_name\s+\K[^;]+' "$conf" | tr ' ' '\n' | sort -u)
                 domain_args=""