diff --git a/ci/prod/scripts/deploy-db.sh b/ci/prod/scripts/deploy-db.sh
index 483521c..6c9ae70 100755
--- a/ci/prod/scripts/deploy-db.sh
+++ b/ci/prod/scripts/deploy-db.sh
@@ -1,23 +1,35 @@
 #!/usr/bin/env bash
-set -euo pipefail
+set -Eeuxo pipefail
+trap 'echo "[deploy-db] failed at line $LINENO"; exit 1' ERR
 
 : "${REMOTE_BASE:?missing REMOTE_BASE}"
 : "${DB_DIR:?missing DB_DIR}"
 : "${SSH_USER:?missing SSH_USER}"
 : "${SSH_HOST:?missing SSH_HOST}"
 
+SSH_OPTS='-i /root/.ssh/id_rsa -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -vv'
 REMOTE_DIR="${REMOTE_BASE%/}/${DB_DIR}"
 REMOTE_TARGET="${SSH_USER}@${SSH_HOST}"
-ssh -o StrictHostKeyChecking=no "$REMOTE_TARGET" "mkdir -p ${REMOTE_DIR}/{compose,env}"
-rsync -avz --delete ci/prod/compose/ "$REMOTE_TARGET:${REMOTE_DIR}/compose/"
-rsync -avz ci/prod/.env.runtime "$REMOTE_TARGET:${REMOTE_DIR}/env/.env.runtime"
-ssh -o StrictHostKeyChecking=no "$REMOTE_TARGET" REMOTE_DIR="$REMOTE_DIR" <<'EOSSH'
-  set -xeuo pipefail
-  cd "${REMOTE_DIR}/compose"
-  set -a
-  . ../env/.env.runtime
-  set +a
-  docker compose -f db.yml pull
-  docker compose -f db.yml up -d --remove-orphans
-  docker compose ps
+
+ssh $SSH_OPTS "$REMOTE_TARGET" 'echo "[whoami] $(whoami) @ $(hostname) $(date -Is)"'
+
+ssh $SSH_OPTS "$REMOTE_TARGET" "mkdir -p ${REMOTE_DIR}/{compose,env}"
+rsync -avz --delete -e "ssh $SSH_OPTS" ci/prod/compose/  "$REMOTE_TARGET:${REMOTE_DIR}/compose/"
+rsync -avz             -e "ssh $SSH_OPTS" ci/prod/.env.runtime "$REMOTE_TARGET:${REMOTE_DIR}/env/.env.runtime"
+
+local_sum="$(sha256sum ci/prod/compose/db.yml | awk '{print $1}')"
+remote_sum="$(ssh $SSH_OPTS "$REMOTE_TARGET" "sha256sum ${REMOTE_DIR}/compose/db.yml | awk '{print \$1}'")"
+echo "[sha256] local=$local_sum remote=$remote_sum"
+
+ssh $SSH_OPTS "$REMOTE_TARGET" REMOTE_DIR="$REMOTE_DIR" <<'EOSSH'
+set -Eeuxo pipefail
+cd "${REMOTE_DIR}/compose"
+set -a
+. ../env/.env.runtime
+set +a
+docker compose -f db.yml pull
+docker compose -f db.yml up -d --remove-orphans
+docker compose ps
+date -Is | tee .last_deploy
+logger -t deploy-db "db deployed at $(date -Is) in ${REMOTE_DIR}"
 EOSSH