diff --git a/.cursor/rules/deploy.mdc b/.cursor/rules/deploy.mdc
new file mode 100644
index 0000000..c03aaca
--- /dev/null
+++ b/.cursor/rules/deploy.mdc
@@ -0,0 +1,33 @@
+---
+description: Canonical production deploy for crm.montzar.ir — always use npm, never invent alternate commands
+alwaysApply: true
+---
+
+# Deploy (locked)
+
+Source of truth: [`deploy/DEPLOY.md`](deploy/DEPLOY.md).
+
+When giving deploy / update steps after a push, paste **exactly** this block (or the matching section in that file). Do not invent variants.
+
+```bash
+ssh -p 3031 montime@185.50.38.53
+cd /var/www/crm
+git pull
+
+npm run build -w @mento/shared
+cd apps/api && npx prisma migrate deploy && npx prisma generate && cd ../..
+npm run build -w @mento/api
+npm run build -w @mento/web
+pm2 restart mento-crm-api
+# only if STT deps changed:
+# pm2 restart mento-stt
+```
+
+## Hard rules
+
+- Package manager is **npm workspaces** (`npm run … -w @mento/…`). **Never** suggest `pnpm` or `yarn`.
+- Prisma: always from `apps/api` (needs `apps/api/.env`). Never `prisma migrate` from repo root.
+- Build order: `shared` → migrate/generate → `api` → `web` → `pm2 restart mento-crm-api`.
+- Host: `185.50.38.53`, SSH port `3031`, user `montime`, path `/var/www/crm`, PM2 `mento-crm-api`.
+- Do not touch other apps’ ports/PM2 names on that server.
+- If deploy docs and chat history disagree, **DEPLOY.md + this rule win**.
diff --git a/deploy/DEPLOY.md b/deploy/DEPLOY.md
index 17e0573..d6d9e18 100644
--- a/deploy/DEPLOY.md
+++ b/deploy/DEPLOY.md
@@ -1,5 +1,26 @@
 # استقرار منتو CRM — `crm.montzar.ir`
 
+> **قفل‌شده:** فقط همین فایل منبع دستورات استقرار است. پکیج‌منیجر = **npm** (نه pnpm/yarn).  
+> قانون Cursor: `.cursor/rules/deploy.mdc`
+
+## آپدیت سریع (بعد از هر `git push`) — همیشه همین
+
+```bash
+ssh -p 3031 montime@185.50.38.53
+cd /var/www/crm
+git pull
+
+npm run build -w @mento/shared
+cd apps/api && npx prisma migrate deploy && npx prisma generate && cd ../..
+npm run build -w @mento/api
+npm run build -w @mento/web
+pm2 restart mento-crm-api
+# فقط اگر STT عوض شده:
+# pm2 restart mento-stt
+```
+
+---
+
 هاست مشترک مونتایم: `185.50.38.53` (SSH پورت `3031`، کاربر `montime`)  
 دامنه: `https://crm.montzar.ir`  
 مسیر کد: `/var/www/crm`  
@@ -170,23 +191,16 @@ sudo nginx -t && sudo systemctl reload nginx
 
 ## آپدیت بعدی (بعد از `git push`)
 
-```bash
-ssh -p 3031 montime@185.50.38.53
-cd /var/www/crm
-git pull
+همان بلوک **«آپدیت سریع»** بالای فایل. نکات اضافه فقط در صورت نیاز:
 
+```bash
 # اگر node_modules از tarball تازه شد، دوباره symlink:
 # rm -rf node_modules/@mento/shared && ln -s ../../packages/shared node_modules/@mento/shared
 # chmod +x node_modules/.bin/*
 
-npm run build -w @mento/shared
-cd apps/api && npx prisma migrate deploy && npx prisma generate && cd ../..
-npm run build -w @mento/api
-npm run build -w @mento/web
-pm2 restart mento-crm-api
 # اگر requirements.txt عوض شد:
 # cd apps/stt && .venv/bin/pip install -r requirements.txt && cd ../..
-pm2 restart mento-stt
+# pm2 restart mento-stt
 ```
 
 پاک نکنید: `uploads/` و `apps/api/.env`