diff --git a/deploy/scripts/deploy_prod.sh b/deploy/scripts/deploy_prod.sh
index 7621695..0d6f4b5 100755
--- a/deploy/scripts/deploy_prod.sh
+++ b/deploy/scripts/deploy_prod.sh
@@ -1,6 +1,31 @@
 #!/usr/bin/env bash
 set -euo pipefail
 
+# DEPRECATED — production migrated from Docker Swarm to k3s on 2026-04-24.
+# This script targets the old Swarm manager + registry flow and will fail
+# at the SSH/Swarm validation step because hetzner1 no longer runs dockerd.
+#
+# Use the k3s deploy stack instead:
+#
+#   export KUBECONFIG="$(pwd)/deploy-k3s/kubeconfig"
+#   ./deploy-k3s/scripts/03-deploy.sh
+#
+# If you don't have deploy-k3s/kubeconfig locally, fetch it once:
+#   ssh -i ~/.ssh/hetzner deploy@hetzner1 'sudo cat /etc/rancher/k3s/k3s.yaml' \
+#     | sed 's|server: https://127.0.0.1:6443|server: https://178.104.247.152:6443|' \
+#     > deploy-k3s/kubeconfig
+#   chmod 600 deploy-k3s/kubeconfig
+#
+# To override and run anyway (do NOT do this casually), set:
+#   ALLOW_LEGACY_SWARM_DEPLOY=1 ./deploy/scripts/deploy_prod.sh
+if [[ "${ALLOW_LEGACY_SWARM_DEPLOY:-0}" != "1" ]]; then
+  printf '[deploy][error] %s\n' \
+    "deploy_prod.sh is the legacy Docker Swarm flow. Production now runs on k3s." \
+    "Use ./deploy-k3s/scripts/03-deploy.sh instead (see top of this script for setup)." \
+    "If you really need the old Swarm path, set ALLOW_LEGACY_SWARM_DEPLOY=1." >&2
+  exit 1
+fi
+
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 DEPLOY_DIR="$(cd "${SCRIPT_DIR}/.." && pwd)"
 REPO_DIR="$(cd "${DEPLOY_DIR}/.." && pwd)"