diff --git a/README.md b/README.md
index bf4e728..c255294 100644
--- a/README.md
+++ b/README.md
@@ -247,7 +247,7 @@ against `BUILD.json`, swaps it into `/srv/bot/app` (bind-mounted at `/app`, prev
 and restarts the container. `PYTHONPATH=/app/vendor` is how the code finds its dependencies, so **a new
 dependency never needs an image rebuild** and the server never contacts a package index.
 
-    ./deployBotBundle.sh vanguard-bot-bundle.tar.gz   # install a release (downloaded from the ci workflow)
+    ./deployBotBundle.sh vanguard-bot-bundle.zip      # install a release (the artifact as Gitea hands it over, zip or tar.gz)
     ./deployBotBundle.sh --latest                     # fetch the newest main build first (needs BOT_REPO_TOKEN in .env)
     ./deployBotBundle.sh --status                     # version, commit, package list, container state
     ./deployBotBundle.sh --rollback                   # back to the previous bundle
diff --git a/deployBotBundle.sh b/deployBotBundle.sh
index 5c36712..57e9f3a 100755
--- a/deployBotBundle.sh
+++ b/deployBotBundle.sh
@@ -25,6 +25,19 @@ BOT_REPO_TOKEN="${BOT_REPO_TOKEN:-$(fromenv BOT_REPO_TOKEN)}"
 say() { printf '\n== %s\n' "$*"; }
 die() { echo "error: $*" >&2; exit 1; }
 
+unwrap() {   # unwrap <downloaded-file> <destination.tar.gz>  — Gitea hands out artifacts as a zip holding the tar.gz
+  if python3 -c "import zipfile,sys; sys.exit(0 if zipfile.is_zipfile(sys.argv[1]) else 1)" "$1"; then
+    python3 - "$1" "$2" <<'PYZIP'
+import sys,zipfile
+with zipfile.ZipFile(sys.argv[1]) as archive:
+    names=[n for n in archive.namelist() if n.endswith('.tar.gz')] or archive.namelist()
+    if not names: sys.exit('the zip holds no files')
+    open(sys.argv[2],'wb').write(archive.read(names[0]))
+PYZIP
+    echo "  (unpacked $(basename "$1"): a zip from Gitea)"
+  elif [[ $1 != "$2" ]]; then cp -f "$1" "$2"; fi
+}
+
 summary() {  # summary <bundle-root>
   python3 - "$1" <<'PY'
 import json,sys,pathlib
@@ -62,18 +75,10 @@ ok=[a for a in items if not a.get('expired')]
 if not ok: sys.exit('no unexpired vanguard-bot-bundle artifact — check the ci workflow ran')
 print(sorted(ok,key=lambda a:a.get('created_at',''))[-1]['archive_download_url'])")
     curl -fsSL -H "Authorization: token $BOT_REPO_TOKEN" -o "$TARBALL.zip" "$URL"
-    # Gitea serves artifacts as a zip holding the tar.gz
-    if python3 -c "import zipfile,sys; sys.exit(0 if zipfile.is_zipfile(sys.argv[1]) else 1)" "$TARBALL.zip"; then
-      python3 - "$TARBALL.zip" "$TARBALL" <<'PY'
-import sys,zipfile
-with zipfile.ZipFile(sys.argv[1]) as z:
-    name=[n for n in z.namelist() if n.endswith('.tar.gz')] or z.namelist()
-    open(sys.argv[2],'wb').write(z.read(name[0]))
-PY
-    else mv "$TARBALL.zip" "$TARBALL"; fi
-    rm -f "$TARBALL.zip" ;;
+    unwrap "$TARBALL.zip" "$TARBALL"; rm -f "$TARBALL.zip" ;;
   "" | -h | --help) sed -n '2,20p' "$0"; exit 2 ;;
-  *) TARBALL="$1"; [[ -f $TARBALL ]] || die "no such file: $TARBALL" ;;
+  *) [[ -f $1 ]] || die "no such file: $1"
+     TARBALL=$(mktemp /tmp/vanguard-bot-bundle.XXXXXX.tar.gz); unwrap "$1" "$TARBALL" ;;
 esac
 
 say "staging $TARBALL"