diff --git a/.gitea/workflows/container.yml b/.gitea/workflows/container.yml
index c3e877e..0f1bd7a 100644
--- a/.gitea/workflows/container.yml
+++ b/.gitea/workflows/container.yml
@@ -64,6 +64,12 @@ jobs:
             --upload-file "dist/immich-sync-${CHART_VERSION}.tgz" \
             https://code.brunner.ninja/api/packages/feedc0de/helm/api/charts
 
+      - name: Check that this is still current main
+        if: gitea.ref == 'refs/heads/main'
+        run: |
+          git fetch --no-tags origin main
+          test "$(git rev-parse FETCH_HEAD)" = "${GITEA_SHA}"
+
       - name: Check out GitOps repository
         if: gitea.ref == 'refs/heads/main'
         uses: actions/checkout@v4
@@ -85,4 +91,14 @@ jobs:
           git add bootstrap/immich-sync.yaml
           if git diff --cached --quiet; then exit 0; fi
           git commit -m "Deploy immich-sync chart ${CHART_VERSION}"
-          git push origin HEAD:main
+          for attempt in 1 2 3; do
+            if git push origin HEAD:main; then
+              exit 0
+            fi
+            if [ "${attempt}" = 3 ]; then
+              echo "GitOps promotion failed after three attempts" >&2
+              exit 1
+            fi
+            git fetch origin main
+            git rebase origin/main
+          done