diff --git a/.github/workflows/deployment.yml b/.github/workflows/deployment.yml
index 758acf7..b7e4c96 100644
--- a/.github/workflows/deployment.yml
+++ b/.github/workflows/deployment.yml
@@ -25,4 +25,4 @@ jobs:
         chmod 644 ~/.ssh/known_hosts
         ssh-keyscan pandorabox.io >> ~/.ssh/known_hosts
         # execute deployment script
-        cat scripts/deploy.sh | ssh root@pandorabox.io "cd /data/pandorabox.io && /bin/sh -"
+        cat scripts/deploy.sh | ssh root@pandorabox.io "cd /data/pandorabox.io && /bin/bash -"
diff --git a/scripts/deploy.sh b/scripts/deploy.sh
index 8cde798..cead575 100755
--- a/scripts/deploy.sh
+++ b/scripts/deploy.sh
@@ -1,6 +1,11 @@
 #!/bin/sh
 # deployment script for automated updates via github actions
 
+# ensure exclusive execution with flock
+LOCK_FILE=/tmp/pandorabox-deployment.lock
+exec 200>"$LOCK_FILE"
+flock -n 200 || exit
+
 # get latest repo version
 git pull