diff --git a/.gitea/workflows/ci-cd.yaml b/.gitea/workflows/ci-cd.yaml
index c8157e1..0da82a0 100644
--- a/.gitea/workflows/ci-cd.yaml
+++ b/.gitea/workflows/ci-cd.yaml
@@ -82,8 +82,12 @@ jobs:
           chmod 600 ~/.ssh/id_ed25519
 
           echo "--- Pre-flight: ensure NAS is reachable ---"
-          ssh -o StrictHostKeyChecking=no -o ConnectTimeout=5 \
-              "$NAS_USER@$NAS_HOST" 'hostname && docker version --format "{{.Server.Version}}"' \
+          # NAS_HOST can be either "host" or "host:port"
+          NAS_SSH_PORT=$(echo "$NAS_HOST" | grep -q ':' && echo "${NAS_HOST##*:}" || echo "22")
+          NAS_SSH_HOST="${NAS_HOST%%:*}"
+          echo "Using NAS_SSH_HOST=$NAS_SSH_HOST NAS_SSH_PORT=$NAS_SSH_PORT"
+          ssh -o StrictHostKeyChecking=no -o ConnectTimeout=5 -p "$NAS_SSH_PORT" \
+              "$NAS_USER@$NAS_SSH_HOST" 'hostname && docker version --format "{{.Server.Version}}"' \
               | head
 
           echo "--- Reading docker-compose.prod.yml from the repo ---"
@@ -97,8 +101,8 @@ jobs:
           # the compose file over SSH and let docker compose recreate the
           # project. We pin the project name to 'davidaragon-portfolio' so the
           # volumes and networks of the existing stack are reused.
-          cat "$COMPOSE_FILE" | ssh -o StrictHostKeyChecking=no \
-              "$NAS_USER@$NAS_HOST" \
+          cat "$COMPOSE_FILE" | ssh -o StrictHostKeyChecking=no -p "$NAS_SSH_PORT" \
+              "$NAS_USER@$NAS_SSH_HOST" \
               "export PATH=/share/CACHEDEV1_DATA/.qpkg/container-station/usr/bin:\$PATH; cd /tmp && docker compose -p '$STACK_NAME' -f - up -d"
 
           echo "--- Stack '$STACK_NAME' redeployed. Smoke-test: ---"