diff --git a/.github/workflows/deploy-private-ross.yml b/.github/workflows/deploy-private-ross.yml
index 5790f2843..e529d2e06 100644
--- a/.github/workflows/deploy-private-ross.yml
+++ b/.github/workflows/deploy-private-ross.yml
@@ -134,6 +134,7 @@ jobs:
           --config deploy/fly/api.toml
           --app "$API_APP"
           --remote-only
+          --no-cache
           --ha=false
 
       - name: Deploy private ROSS website
@@ -146,6 +147,7 @@ jobs:
             --config deploy/fly/frontend.toml \
             --app "$WEB_APP" \
             --remote-only \
+            --no-cache \
             --ha=false \
             --build-arg "NEXT_PUBLIC_SUPABASE_URL=${ROSS_SUPABASE_URL}" \
             --build-arg "NEXT_PUBLIC_SUPABASE_PUBLISHABLE_DEFAULT_KEY=${ROSS_SUPABASE_PUBLISHABLE_KEY}" \
diff --git a/tests/baseline/private-deployment.test.mjs b/tests/baseline/private-deployment.test.mjs
index 6920c41c7..ea6f14df4 100644
--- a/tests/baseline/private-deployment.test.mjs
+++ b/tests/baseline/private-deployment.test.mjs
@@ -21,6 +21,16 @@ test("private deployment is manual, Toronto-hosted, and owner-only", () => {
   assert.match(frontend, /primary_region = "yyz"/);
 });
 
+test("private deployment rebuilds both application images from current source", () => {
+  const workflow = read(".github/workflows/deploy-private-ross.yml");
+
+  const deployCommands = workflow.match(/flyctl deploy[\s\S]*?(?=\n\s+- name:|$)/g) ?? [];
+  assert.equal(deployCommands.length, 2);
+  for (const command of deployCommands) {
+    assert.match(command, /--no-cache/);
+  }
+});
+
 test("private deployment credentials are supplied only through GitHub secrets", () => {
   const workflow = read(".github/workflows/deploy-private-ross.yml");
   for (const name of [
@@ -36,4 +46,3 @@ test("private deployment credentials are supplied only through GitHub secrets",
     assert.match(workflow, new RegExp(`secrets\\.${name}`), name);
   }
 });
-