diff --git a/.gitea/workflows/deploy.yaml b/.gitea/workflows/deploy.yaml
index d8dfb479..6f25bb11 100644
--- a/.gitea/workflows/deploy.yaml
+++ b/.gitea/workflows/deploy.yaml
@@ -42,6 +42,8 @@ jobs:
           # 3. Fetch and update code
           git fetch origin --prune
           git reset --hard origin/main
+          # Drop stray untracked sources left on the host (keep secrets/env).
+          git clean -fd -e .env -e .env.local -e .env.production -e .env*.local -- src
 
           # Preserve .next/cache so Next.js can reuse its incremental build cache.
           rm -rf .output dist
diff --git a/src/actions/admin-housekeeping.ts b/src/actions/admin-housekeeping.ts
index 277451c0..21c76465 100644
--- a/src/actions/admin-housekeeping.ts
+++ b/src/actions/admin-housekeeping.ts
@@ -54,3 +54,26 @@ export async function deletePermission(formData: FormData): Promise<void> {
 
 	revalidatePath("/admin/housekeeping");
 }
+
+/**
+ * Export housekeeping permissions as plain JSON-serializable rows
+ * (used by the admin export UI).
+ */
+export async function exportPermissions(): Promise<
+	{ permission: string; minRank: number; description: string | null }[]
+> {
+	await requirePermission(PERMS.SETTINGS_VIEW);
+
+	try {
+		return await prisma.websiteHousekeepingPermissions.findMany({
+			orderBy: { permission: "asc" },
+			select: {
+				permission: true,
+				minRank: true,
+				description: true,
+			},
+		});
+	} catch {
+		return [];
+	}
+}