diff --git a/scripts/preview/init.sh b/scripts/preview/init.sh
index 34050f1..109f94d 100644
--- a/scripts/preview/init.sh
+++ b/scripts/preview/init.sh
@@ -20,7 +20,8 @@ actual=$(docker run --rm --entrypoint node \
  "$IMAGE" /tmp/preview-fingerprint.mjs /repo)
 [[ "$actual" == "$expected" ]] || { echo 'Tooling image does not match preview dependencies/configuration/schema' >&2; exit 1; }
 install -d -m 0700 "$ROOT"
-install -d -m 0755 -o 1000 -g 1000 "$ROOT/source" "$ROOT/status"
+install -d -m 0755 "$ROOT/source" "$ROOT/status"
+chown 1000:1000 "$ROOT/source" "$ROOT/status"
 # Create independent preview credentials only once, never copy production secrets.
 if [ ! -s "$ROOT/env" ]; then
  ROOT="$ROOT" IMAGE="$IMAGE" PORT="$PORT" python3 - <<'PY'
@@ -32,7 +33,7 @@ with p.open('x') as f:
  for key in ['POSTGRES_PASSWORD','S3_ACCESS_KEY','S3_SECRET_KEY']:f.write(key+'='+secrets.token_hex(24)+'\n')
 PY
 fi
-rsync -a --delete --chown=1000:1000 \
+rsync -a --delete --numeric-ids --chown=1000:1000 \
  --exclude='.git' --exclude='node_modules' --exclude='.next' --exclude='dist' \
  --exclude='*.tsbuildinfo' --exclude='.env' --exclude='.env.*' --exclude='.gitea' \
  "$SOURCE/" "$ROOT/source/"
diff --git a/scripts/preview/sync.sh b/scripts/preview/sync.sh
index e2fa0de..860f93b 100644
--- a/scripts/preview/sync.sh
+++ b/scripts/preview/sync.sh
@@ -7,6 +7,9 @@ BRANCH=${3:?branch required}
 ROOT=/opt/prompt-preview
 exec 8>/var/lock/prompt-preview-sync.lock
 flock -w 30 8
+latest=$(git -C "$SOURCE" ls-remote origin "refs/heads/$BRANCH" | cut -f1)
+test -n "$latest"
+if [ "$latest" != "$SHA" ]; then echo "Skipping superseded preview commit $SHA"; exit 0; fi
 candidate=$(node "$SOURCE/scripts/preview/fingerprint.mjs" "$SOURCE")
 if [ ! -s "$ROOT/fingerprint" ]; then
  echo 'Preview is not initialized; run scripts/preview/init.sh once with a verified tooling image' >&2
@@ -19,7 +22,7 @@ fi
 id=$(docker compose -p prompt-preview --env-file "$ROOT/env" -f "$ROOT/compose.yml" ps -q waterfall-wiki)
 test -n "$id" && test "$(docker inspect --format '{{.State.Running}}' "$id")" = true
 # No git credentials, dependency folders, compiler output or environment files are copied.
-rsync -a --checksum --no-times --delete --chown=1000:1000 \
+rsync -a --checksum --no-times --delete --numeric-ids --chown=1000:1000 \
  --exclude='.git' --exclude='node_modules' --exclude='.next' --exclude='dist' \
  --exclude='*.tsbuildinfo' --exclude='.env' --exclude='.env.*' --exclude='.gitea' \
  --exclude='/apps/waterfall-wiki/public/brand/' --exclude='/apps/waterfall-wiki/public/favicon.ico' --exclude='/apps/waterfall-wiki/public/apple-touch-icon.png' "$SOURCE/" "$ROOT/source/"
@@ -28,7 +31,7 @@ assets="$ROOT/source/packages/brand/assets"
 public="$ROOT/source/apps/waterfall-wiki/public"
 mkdir -p "$public/brand"
 copy_asset() {
- cmp -s "$1" "$2" || install -o 1000 -g 1000 -m 0644 "$1" "$2"
+ cmp -s "$1" "$2" || install -m 0644 "$1" "$2"
 }
 for name in logo-light.svg logo-dark.svg icon-dark.svg; do copy_asset "$assets/svg/$name" "$public/brand/$name"; done
 copy_asset "$assets/icons/favicon.ico" "$public/favicon.ico"