diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml
index 01dc7f5..8938a7f 100644
--- a/.github/workflows/deploy.yml
+++ b/.github/workflows/deploy.yml
@@ -48,6 +48,14 @@ jobs:
         with:
           credentials_json: ${{ secrets.GCP_PROD_SERVICE_ACCOUNT_KEY }}
 
+      - name: Refresh Pulumi state (one-off fix for out-of-sync state)
+        env:
+          PULUMI_PASSPHRASE: ${{ secrets.PULUMI_PROD_PASSPHRASE }}
+        run: |
+          echo "$PULUMI_PASSPHRASE" > passphrase.prod.txt
+          pulumi login gs://mcp-dns-prod-pulumi-state
+          PULUMI_CONFIG_PASSPHRASE_FILE=passphrase.prod.txt pulumi refresh --yes --stack prod
+
       - name: Deploy to Production
         env:
           PULUMI_PASSPHRASE: ${{ secrets.PULUMI_PROD_PASSPHRASE }}
diff --git a/package.json b/package.json
index 7ada08d..567b95c 100644
--- a/package.json
+++ b/package.json
@@ -10,8 +10,8 @@
   },
   "license": "MIT",
   "dependencies": {
-    "@pulumi/cloudflare": "^6.12.0",
-    "@pulumi/pulumi": "^3.214.1"
+    "@pulumi/cloudflare": "^6.13.0",
+    "@pulumi/pulumi": "^3.218.0"
   },
   "devDependencies": {
     "@types/node": "^22.18.6",