diff --git a/scripts/production-deploy.py b/scripts/production-deploy.py
index 88dbc1a..bc8dcea 100644
--- a/scripts/production-deploy.py
+++ b/scripts/production-deploy.py
@@ -850,7 +850,6 @@ class Deploy:
             self.state["status"] = "success"
             self.state_io(self.state)
             print("DEPLOY VERIFIED", flush=True)
-            self.cleanup_images()
         except BaseException as exc:
             print("DEPLOY FAILED:", type(exc).__name__, flush=True)
             self.diagnostics()
@@ -873,6 +872,10 @@ class Deploy:
             if safe_unlock:
                 self.unlock()
 
+        # The deployment lock itself references the old image. Release it
+        # before retention; other container references remain protected.
+        self.cleanup_images()
+
     def recover(self, manual=False):
         self.settings()
         lock = self.run(
diff --git a/tests/test_production_deploy.py b/tests/test_production_deploy.py
index e5ccbc5..b7a0316 100644
--- a/tests/test_production_deploy.py
+++ b/tests/test_production_deploy.py
@@ -137,6 +137,7 @@ def test_deploy_rolls_back_exact_baseline_without_deleting_data(
     else:
         tool.deploy()
         assert cleanup == ["success"]
+        assert "unlock" in calls
         assert activated == [new]
         assert saved[-1]["status"] == "success"
         assert saved[-1]["rollback_tag"] == tool.old_image_tag + "-rollback"