diff --git a/deploy/push.sh b/deploy/push.sh
index ba5f7e8..bce6a17 100755
--- a/deploy/push.sh
+++ b/deploy/push.sh
@@ -42,8 +42,13 @@ if sh_ "[ -f '$APP/static/index.html' ]" 2>/dev/null; then
 fi
 echo "==> static dir: $STATIC"
 
+# macOS bsdtar writes com.apple.provenance xattrs and ._ resource forks that
+# the NAS's tar cannot read; it warns once per file and copies nothing useful.
+TAR="tar czf - --no-xattrs"
+export COPYFILE_DISABLE=1
+
 echo "==> backend"
-tar czf - --exclude .venv --exclude .env --exclude __pycache__ \
+$TAR --exclude .venv --exclude .env --exclude __pycache__ \
     --exclude '*.db' --exclude tests --exclude .pytest_cache \
     -C "$REPO/backend" . | sh_ "tar xzf - -C '$APP/backend'"
 
@@ -53,7 +58,7 @@ if [ ! -f "$REPO/client/build/index.html" ]; then
   exit 1
 fi
 sh_ "rm -rf '$STATIC' && mkdir -p '$STATIC'"
-tar czf - -C "$REPO/client/build" . | sh_ "tar xzf - -C '$STATIC'"
+$TAR -C "$REPO/client/build" . | sh_ "tar xzf - -C '$STATIC'"
 
 echo "==> restart"
 sh_ "sh '$APP/deploy/stop.sh' >/dev/null 2>&1; sleep 2; sh '$APP/deploy/start.sh'"