diff --git a/backend/src/constants.py b/backend/src/constants.py
index 4aec2ff2..41b24c96 100644
--- a/backend/src/constants.py
+++ b/backend/src/constants.py
@@ -6,7 +6,15 @@
 PROD = os.getenv("PROD", "False") == "True"
 
 # 8001 emulates the data server
-BACKEND_URL = "https://api.statbotics.io" if PROD else "http://localhost:8001"
+# The ETL self-trigger (update_curr_year_background, the freshness ping probe)
+# HTTP-calls BACKEND_URL to reach the data router. In the original multi-service
+# layout the data router was a separate service; on the single-container mirror
+# it is the SAME service, so BACKEND_URL must point at the mirror's own backend
+# (set the env var to the run.app URL), not upstream api.statbotics.io — else the
+# self-trigger hits the wrong host and ingestion never runs.
+BACKEND_URL = os.getenv("BACKEND_URL") or (
+    "https://api.statbotics.io" if PROD else "http://localhost:8001"
+)
 
 # DB
 
diff --git a/docs/superpowers/rig/deploy/Makefile b/docs/superpowers/rig/deploy/Makefile
index fd79e8ea..5562360e 100644
--- a/docs/superpowers/rig/deploy/Makefile
+++ b/docs/superpowers/rig/deploy/Makefile
@@ -40,14 +40,13 @@ API_CPU      ?= 2
 UPDATE_SCHED ?= statbotics-update
 GC_SCHED     ?= statbotics-gc
 
-# Build/deploy the DEPLOY BRANCH checkout, not the main worktree. docs/ (where
-# this Makefile lives) is git-excluded and only exists in the main checkout on
-# `master`, but the code + Dockerfiles that get deployed live on the `staging`
-# branch — its worktree at <main>/.worktrees/staging. MAIN_DIR is 4 up from
-# here; DEPLOY_DIR is the staging worktree. Override DEPLOY_DIR to deploy a
-# different checkout.
+# Build/deploy the DEPLOY BRANCH checkout, not the main worktree. The code +
+# Dockerfiles that get deployed live on the `cph-staging` branch (the deployed
+# fork line) — its worktree at <main>/.worktrees/cph-staging. MAIN_DIR is 4 up
+# from here; DEPLOY_DIR is the cph-staging worktree. Override DEPLOY_DIR to
+# deploy a different checkout.
 MAIN_DIR     ?= $(abspath $(dir $(lastword $(MAKEFILE_LIST)))/../../../..)
-DEPLOY_DIR   ?= $(MAIN_DIR)/.worktrees/staging
+DEPLOY_DIR   ?= $(MAIN_DIR)/.worktrees/cph-staging
 BACKEND_DIR  ?= $(DEPLOY_DIR)/backend
 FRONTEND_DIR ?= $(DEPLOY_DIR)/frontend
 SMOKE        ?= $(MAIN_DIR)/docs/superpowers/rig/smoke/smoke.py
diff --git a/docs/superpowers/rig/smoke/smoke.py b/docs/superpowers/rig/smoke/smoke.py
index 2e7872c5..9d585cd2 100644
--- a/docs/superpowers/rig/smoke/smoke.py
+++ b/docs/superpowers/rig/smoke/smoke.py
@@ -41,6 +41,14 @@
 import urllib.request
 import zlib
 
+# Send a browser-like User-Agent on every request. Cloudflare (which fronts the
+# staging mirror) returns 403 to the default Python-urllib UA as suspected-bot
+# traffic, which otherwise fails every https check against the live mirror.
+_UA = "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) statbotics-smoke/1.0"
+_opener = urllib.request.build_opener()
+_opener.addheaders = [("User-Agent", _UA)]
+urllib.request.install_opener(_opener)
+
 TOL = 0.5  # EPA point tolerance for blob-vs-API equality
 
 _results = []