diff --git a/README.md b/README.md
index 4e6b333..aa2c684 100644
--- a/README.md
+++ b/README.md
@@ -54,6 +54,24 @@ ssh-add --apple-use-keychain ~/.ssh/id_ed25519
 
 After this, `ssh t-gstone.de` connects without any password prompts.
 
+## Syncing to the VPS
+
+If the VPS doesn't have a git remote set up yet, use `rsync` over SSH to push the repo:
+
+```bash
+# Sync the repo to the VPS (dry-run first to check what would be sent)
+rsync -avz --dry-run -e 'ssh -p 55' \
+  --exclude '.env' --exclude '*/.env' --exclude '.git' \
+  ./ gstone@t-gstone.de:~/nextcloud-selfhosted/
+
+# Run for real (remove --dry-run)
+rsync -avz -e 'ssh -p 55' \
+  --exclude '.env' --exclude '*/.env' --exclude '.git' \
+  ./ gstone@t-gstone.de:~/nextcloud-selfhosted/
+```
+
+The `.env` files are excluded because they contain secrets and should be created directly on the VPS from the `.env.example` templates.
+
 ## Quick Start
 
 ```bash
diff --git a/scripts/deploy.sh b/scripts/deploy.sh
index e91e54e..2bfd151 100755
--- a/scripts/deploy.sh
+++ b/scripts/deploy.sh
@@ -61,6 +61,7 @@ echo "==> Creating data directories under $DATA_ROOT..."
 mkdir -p "$DATA_ROOT"/{caddy/data,caddy/config}
 mkdir -p "$DATA_ROOT"/{nextcloud/html,nextcloud/data,nextcloud/db}
 mkdir -p "$DATA_ROOT"/{gitea/data,gitea/config}
+chown -R 1000:1000 "$DATA_ROOT"/gitea
 mkdir -p /opt/backups
 
 # ------------------------------------------------------------------