diff --git a/scripts/deploy-dispatch.sh b/scripts/deploy-dispatch.sh
index cf3e117..9d9dea6 100755
--- a/scripts/deploy-dispatch.sh
+++ b/scripts/deploy-dispatch.sh
@@ -2,8 +2,8 @@
 set -euo pipefail
 
 case "$SSH_ORIGINAL_COMMAND" in
-    deploy-nginx)       /opt/hantim/scripts/deploy-nginx.sh ;;
-    deploy-timothykim)  /opt/hantim/scripts/deploy-timothykim.sh ;;
+    deploy-nginx)       sudo /opt/hantim/scripts/deploy-nginx.sh ;;
+    deploy-timothykim)  sudo /opt/hantim/scripts/deploy-timothykim.sh ;;
     *)
         echo "Unknown command: $SSH_ORIGINAL_COMMAND"
         echo "Available: deploy-nginx, deploy-timothykim"
diff --git a/scripts/new-app.sh b/scripts/new-app.sh
index fb892e6..3ee7939 100755
--- a/scripts/new-app.sh
+++ b/scripts/new-app.sh
@@ -38,7 +38,7 @@ EOF
 chmod +x "$REPO_ROOT/scripts/deploy-$APP.sh"
 
 echo "Adding $APP to deploy-dispatch.sh..."
-sed -i "/^    \*)$/i\\    deploy-$APP) /opt/hantim/scripts/deploy-$APP.sh ;;" \
+sed -i "/^    \*)$/i\\    deploy-$APP) sudo /opt/hantim/scripts/deploy-$APP.sh ;;" \
     "$REPO_ROOT/scripts/deploy-dispatch.sh"
 
 echo "Creating .gitea/workflows/deploy-$APP.yml..."
diff --git a/setup.sh b/setup.sh
index 5566976..bc8229a 100755
--- a/setup.sh
+++ b/setup.sh
@@ -86,7 +86,12 @@ if [ ! -f /home/deploy/.ssh/authorized_keys ]; then
     echo "  into /home/deploy/.ssh/authorized_keys"
 fi
 chown -R deploy:deploy /home/deploy/.ssh
-su -s /bin/bash deploy -c "git config --global --add safe.directory $REPO_DIR"
+
+echo "==> Configuring sudo for deploy user..."
+cat > /etc/sudoers.d/deploy <<SUDOERS
+deploy ALL=(root) NOPASSWD: /opt/hantim/scripts/deploy-*.sh
+SUDOERS
+chmod 440 /etc/sudoers.d/deploy
 
 # --- Start services ---