diff --git a/scripts/docker-swarm/deploy.sh b/scripts/docker-swarm/deploy.sh
index 9268dcf..3499e58 100755
--- a/scripts/docker-swarm/deploy.sh
+++ b/scripts/docker-swarm/deploy.sh
@@ -169,12 +169,12 @@ SWARM_USER="nixos"
 
 n1() {
   ssh -i ~/.ssh/id_ed25519 -o StrictHostKeyChecking=no -o ConnectTimeout=5 \
-    "${SWARM_USER}@${NODE1_LAN_IP}" sudo "$@" 2>/dev/null
+    "${SWARM_USER}@${NODE1_LAN_IP}" "$@" 2>/dev/null
 }
 
 n2() {
   ssh -i ~/.ssh/id_ed25519 -o StrictHostKeyChecking=no -o ConnectTimeout=5 \
-    "${SWARM_USER}@${NODE2_LAN_IP}" sudo "$@" 2>/dev/null
+    "${SWARM_USER}@${NODE2_LAN_IP}" "$@" 2>/dev/null
 }
 
 dc() {
@@ -468,7 +468,7 @@ if ! $SKIP_INIT_SWARM; then
     logn "[dry-run] Would label both nodes"
   else
     # Check if node1 is already a swarm manager.
-    if n1 "docker info --format '{{.Swarm.LocalNodeState}}'" 2>/dev/null | grep -q "active"; then
+    if n1 "docker info --format '{{.Swarm.LocalNodeState}}'" 2>/dev/null | grep -qx "active"; then
       logn "${NODE1_HOST} is already in a swarm — skipping init."
     else
       logn "Initialising swarm on ${NODE1_HOST} (advertise: ${NODE1_SWARM_IP})..."
@@ -479,7 +479,7 @@ if ! $SKIP_INIT_SWARM; then
     fi
 
     # Check if node2 is already joined.
-    if n2 "docker info --format '{{.Swarm.LocalNodeState}}'" 2>/dev/null | grep -q "active"; then
+    if n2 "docker info --format '{{.Swarm.LocalNodeState}}'" 2>/dev/null | grep -qx "active"; then
       logn "${NODE2_HOST} is already in the swarm — skipping join."
     else
       logn "Fetching manager join token from ${NODE1_HOST}..."
@@ -559,7 +559,7 @@ if ! $SKIP_VERIFY; then
     for spec in "${NODE1_LAN_IP}:${NODE1_HOST}" "${NODE2_LAN_IP}:${NODE2_HOST}"; do
       IFS=: read -r ip hostname <<< "$spec"
       STATE=$(ssh -i ~/.ssh/id_ed25519 -o StrictHostKeyChecking=no \
-        "${SWARM_USER}@${ip}" "sudo docker info --format '{{.Swarm.LocalNodeState}}'" 2>/dev/null)
+        "${SWARM_USER}@${ip}" "docker info --format '{{.Swarm.LocalNodeState}}'" 2>/dev/null)
       if [[ "$STATE" != "active" ]]; then
         err "${hostname} swarm state is '${STATE}', expected 'active'"
       fi