diff --git a/deploy/prod/deploy.sh b/deploy/prod/deploy.sh
index 1c5f0917b..5bbf3b77e 100755
--- a/deploy/prod/deploy.sh
+++ b/deploy/prod/deploy.sh
@@ -6,6 +6,16 @@ TAG=${1:?usage: deploy.sh prod-<40-char-sha>}
 [[ "$TAG" =~ ^prod-[0-9a-f]{40}$ ]] || { echo 'invalid immutable image tag' >&2; exit 2; }
 [[ -s .env ]] || { echo '/opt/langbot-cloud-prod/.env is missing' >&2; exit 3; }
 
+rendered_compose=$(docker compose config)
+grep -Fq 'LANGBOT_SPACE_CONTROL_PLANE_URL: https://space.langbot.app' <<<"$rendered_compose" || {
+  echo 'Cloud control-plane URL must be https://space.langbot.app' >&2
+  exit 4
+}
+grep -Fq 'SPACE__URL: https://space.langbot.app' <<<"$rendered_compose" || {
+  echo 'Cloud user-facing Space URL must be https://space.langbot.app' >&2
+  exit 5
+}
+
 update_env() {
   local key=$1 value=$2
   python3 - "$key" "$value" <<'PY'
diff --git a/deploy/prod/docker-compose.yml b/deploy/prod/docker-compose.yml
index c5808c521..c003d645f 100644
--- a/deploy/prod/docker-compose.yml
+++ b/deploy/prod/docker-compose.yml
@@ -24,7 +24,7 @@ services:
     volumes:
       - redis-data:/data
     healthcheck:
-      test: [CMD-SHELL, "redis-cli -a '$${REDIS_PASSWORD}' ping | grep PONG"]
+      test: [CMD-SHELL, "redis-cli -a \"$${REDIS_PASSWORD}\" ping | grep PONG"]
       interval: 5s
       timeout: 5s
       retries: 20
@@ -55,7 +55,7 @@ services:
       LANGBOT_CLOUD_MIGRATION_DSN: postgresql://langbot_operator:${POSTGRES_OPERATOR_PASSWORD}@postgres:5432/langbot
       VDB__USE: pgvector
       VDB__PGVECTOR__USE_BUSINESS_DATABASE: "true"
-      VDB__PGVECTOR__ALLOWED_DIMENSIONS: "384,512,768,1024,1536"
+      VDB__PGVECTOR__ALLOWED_DIMENSIONS: "[384, 512, 768, 1024, 1536]"
       PLUGIN__ENABLE: "true"
       PLUGIN__RUNTIME_WS_URL: ws://plugin-runtime:5400/control/ws
       PLUGIN__DISPLAY_PLUGIN_DEBUG_URL: wss://cloud.langbot.app/plugin/debug/ws