diff --git a/deploy.php b/deploy.php
index 26fe042..c72a71a 100644
--- a/deploy.php
+++ b/deploy.php
@@ -9,7 +9,6 @@ require 'recipe/symfony.php';
 add('shared_dirs', [
     'config/secret',
     'var/bpn',
-    'var/log',
     'var/sessions',
     'var/jsonexport',
     'var/xmlexport',
@@ -35,6 +34,8 @@ $rsyncOptions = [
         '.jj',
         'node_modules',
         '.editorconfig',
+        '.env.local',
+        '.env.local.php',
         '.env.dev.local',
         '.env.dev.local.php',
         '.env.test',
@@ -76,17 +77,21 @@ $rsyncOptions = [
     'timeout' => 300,
 ];
 
+// Shared by all hosts. The deploy path only differs by the host alias.
+set('deploy_path', '/usr/home/myepsf/public_html/{{alias}}');
+set('bin/php', '/usr/bin/php');
+set('http_user', 'myepsf');
+// Must stay here: contrib/rsync.php sets the same key, but its __DIR__ is the vendor dir.
+set('rsync_src', __DIR__);
+set('rsync', $rsyncOptions);
+set('cachetool_args', '--web=SymfonyHttpClient --web-path={{release_or_current_path}}/public/ --web-url={{web_url}}');
+
 host('prod')
     ->setHostname('dedi10193.your-server.de')
     ->setRemoteUser('myepsf')
     ->setForwardAgent(true)
     ->setSshMultiplexing(true)
-    ->setDeployPath('/usr/home/myepsf/public_html/prod')
-    ->set('bin/php', '/usr/bin/php')
-    ->set('http_user', 'myepsf')
-    ->set('rsync_src', __DIR__)
-    ->set('rsync', $rsyncOptions)
-    ->set('cachetool_args', '--web=SymfonyHttpClient --web-path={{current_path}}/public/ --web-url=https://my.ep-reisen.de')
+    ->set('web_url', 'https://my.ep-reisen.de')
 ;
 
 host('staging')
@@ -94,12 +99,7 @@ host('staging')
     ->setRemoteUser('myepsf')
     ->setForwardAgent(true)
     ->setSshMultiplexing(true)
-    ->setDeployPath('/usr/home/myepsf/public_html/staging')
-    ->set('bin/php', '/usr/bin/php')
-    ->set('http_user', 'myepsf')
-    ->set('rsync_src', __DIR__)
-    ->set('rsync', $rsyncOptions)
-    ->set('cachetool_args', '--web=SymfonyHttpClient --web-path={{current_path}}/public/ --web-url=https://my.ep-reisen.net')
+    ->set('web_url', 'https://my.ep-reisen.net')
     ->add('shared_files', [
         'public/.htpasswd',
     ])
@@ -107,27 +107,34 @@ host('staging')
 
 task('deploy', [
     'deploy:info',
+    'deploy:assets',
     'deploy:setup',
     'deploy:lock',
     'deploy:release',
-    'deploy:assets',
     'rsync',
     'deploy:shared',
     'deploy:writable',
-    'deploy:cache:clear',
+    'deploy:cache:warmup',
     'database:migrate',
-    'cachetool:clear:opcache',
     'deploy:publish',
-    'deploy:stop-workers',
 ]);
 
+// Purely local, so it runs before anything is created on the remote. once(), so
+// deploying multiple hosts at the same time builds the bundle only once.
 task('deploy:assets', function () {
     runLocally('ddev exec npm ci');
     runLocally('ddev exec npm run build');
+})->once();
+
+// The recipe's deploy:cache:clear only does something when composer ran with
+// --no-scripts, which never happens here: vendor/ is rsynced, composer never runs
+// remotely. A fresh release has no var/cache to clear, so warm it up directly.
+// Runs after deploy:writable so the default ACLs are already in place.
+task('deploy:cache:warmup', function () {
+    run('{{bin/console}} cache:warmup {{console_options}}');
 });
 
-task('deploy:stop-workers', function () {
-    run('{{bin/console}} messenger:stop-workers');
-});
+// Opcache has to be reset once the new release is actually live.
+after('deploy:symlink', 'cachetool:clear:opcache');
 
 after('deploy:failed', 'deploy:unlock');