diff --git a/.github/workflows/ci-cd-web-desktop.yml b/.github/workflows/ci-cd-web-desktop.yml
index df18212..ff68e05 100644
--- a/.github/workflows/ci-cd-web-desktop.yml
+++ b/.github/workflows/ci-cd-web-desktop.yml
@@ -72,7 +72,8 @@ jobs:
       - name: Sync workspace to APP_DIR (preserving local env)
         run: |
           mkdir -p "$APP_DIR"
-          rsync -az --no-perms --no-owner --no-group --delete \
+          RSYNC_FLAGS="-az --inplace --no-times --no-perms --no-owner --no-group --delete"
+          rsync $RSYNC_FLAGS \
             --filter='protect node_modules' \
             --filter='protect node_modules/**' \
             --filter='protect .pnpm-store' \
@@ -90,7 +91,26 @@ jobs:
             --exclude '.env*' \
             --exclude 'apps/desktop/.env*' \
             --exclude 'convex/.env*' \
-            ./ "$APP_DIR"/
+            ./ "$APP_DIR"/ \
+            || sudo -n rsync $RSYNC_FLAGS \
+              --filter='protect node_modules' \
+              --filter='protect node_modules/**' \
+              --filter='protect .pnpm-store' \
+              --filter='protect .pnpm-store/**' \
+              --filter='protect .env' \
+              --filter='protect .env*' \
+              --filter='protect apps/desktop/.env*' \
+              --filter='protect convex/.env*' \
+              --exclude '.git' \
+              --exclude '.next' \
+              --exclude 'node_modules' \
+              --exclude 'node_modules/**' \
+              --exclude '.pnpm-store' \
+              --exclude '.pnpm-store/**' \
+              --exclude '.env*' \
+              --exclude 'apps/desktop/.env*' \
+              --exclude 'convex/.env*' \
+              ./ "$APP_DIR"/
 
       - name: Install and build (Next.js)
         run: |
@@ -127,7 +147,8 @@ jobs:
       - name: Sync workspace to APP_DIR (preserving local env)
         run: |
           mkdir -p "$APP_DIR"
-          rsync -az --no-perms --no-owner --no-group --delete \
+          RSYNC_FLAGS="-az --inplace --no-times --no-perms --no-owner --no-group --delete"
+          rsync $RSYNC_FLAGS \
             --filter='protect node_modules' \
             --filter='protect node_modules/**' \
             --filter='protect .pnpm-store' \
@@ -145,7 +166,26 @@ jobs:
             --exclude '.env*' \
             --exclude 'apps/desktop/.env*' \
             --exclude 'convex/.env*' \
-            ./ "$APP_DIR"/
+            ./ "$APP_DIR"/ \
+            || sudo -n rsync $RSYNC_FLAGS \
+              --filter='protect node_modules' \
+              --filter='protect node_modules/**' \
+              --filter='protect .pnpm-store' \
+              --filter='protect .pnpm-store/**' \
+              --filter='protect .env' \
+              --filter='protect .env*' \
+              --filter='protect apps/desktop/.env*' \
+              --filter='protect convex/.env*' \
+              --exclude '.git' \
+              --exclude '.next' \
+              --exclude 'node_modules' \
+              --exclude 'node_modules/**' \
+              --exclude '.pnpm-store' \
+              --exclude '.pnpm-store/**' \
+              --exclude '.env*' \
+              --exclude 'apps/desktop/.env*' \
+              --exclude 'convex/.env*' \
+              ./ "$APP_DIR"/
       - name: Deploy functions to Convex self-hosted
         run: |
           docker run --rm -i \