diff --git a/.github/workflows/hotfix-start.yml b/.github/workflows/hotfix-start.yml
index 4489ce61c..6f1a81e4c 100644
--- a/.github/workflows/hotfix-start.yml
+++ b/.github/workflows/hotfix-start.yml
@@ -72,6 +72,26 @@ jobs:
           git config user.name  "github-actions[bot]"
           git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
           git checkout -b "${{ steps.next.outputs.branch }}" "${{ steps.base.outputs.tag }}"
+
+          # Backport the CD (Production) inline-deploy gate fix. Tags cut before
+          # the fix carry a gate keyed on `github.event_name == 'workflow_call'`,
+          # which is NEVER true inside a called workflow (it inherits the
+          # caller's `push` event), so release-please's inline deploy silently
+          # skips `production-deploy` and the hotfix never ships. Rewrite the
+          # gate to key on `inputs.tag_name` (empty on the release path, so `||`
+          # still falls through). SURGICAL edit only — do not copy the whole
+          # file from the default branch, whose deploy steps may not match this
+          # tag's code.
+          f=.github/workflows/CD_production.yml
+          if [ -f "$f" ] && grep -qF "github.event_name == 'workflow_call'" "$f"; then
+            sed -i "s#(github.event_name == 'workflow_call' && inputs.tag_name) || github.event.release.tag_name#inputs.tag_name || github.event.release.tag_name#g" "$f"
+            git add "$f"
+            git commit -m "ci: backport CD (Production) inline-deploy gate fix"
+            echo "Backported CD (Production) deploy-gate fix onto ${{ steps.next.outputs.branch }}."
+          else
+            echo "CD (Production) deploy gate already current; no backport needed."
+          fi
+
           git push origin "${{ steps.next.outputs.branch }}"
 
       - name: Summary