diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml
index 01dc7f5..8938a7f 100644
--- a/.github/workflows/deploy.yml
+++ b/.github/workflows/deploy.yml
@@ -48,6 +48,14 @@ jobs:
         with:
           credentials_json: ${{ secrets.GCP_PROD_SERVICE_ACCOUNT_KEY }}
 
+      - name: Refresh Pulumi state (one-off fix for out-of-sync state)
+        env:
+          PULUMI_PASSPHRASE: ${{ secrets.PULUMI_PROD_PASSPHRASE }}
+        run: |
+          echo "$PULUMI_PASSPHRASE" > passphrase.prod.txt
+          pulumi login gs://mcp-dns-prod-pulumi-state
+          PULUMI_CONFIG_PASSPHRASE_FILE=passphrase.prod.txt pulumi refresh --yes --stack prod
+
       - name: Deploy to Production
         env:
           PULUMI_PASSPHRASE: ${{ secrets.PULUMI_PROD_PASSPHRASE }}