diff --git a/app/Provisioning/Jobs/CollectInstanceTraffic.php b/app/Provisioning/Jobs/CollectInstanceTraffic.php
index 7839bb6..363d075 100644
--- a/app/Provisioning/Jobs/CollectInstanceTraffic.php
+++ b/app/Provisioning/Jobs/CollectInstanceTraffic.php
@@ -32,7 +32,14 @@ class CollectInstanceTraffic implements ShouldBeUnique, ShouldQueue
 {
     use Dispatchable, InteractsWithQueue, Queueable, SerializesModels;
 
-    public int $uniqueFor = 900;
+    /**
+     * Comfortably longer than the 15-minute cadence. At exactly one interval the
+     * lock would expire as the next run is dispatched, and two collectors
+     * sharing a baseline would add the same delta twice — throttling a customer
+     * for traffic they never used. The lock is released when the job finishes,
+     * so a longer expiry only covers the crash case.
+     */
+    public int $uniqueFor = 3600;
 
     public int $tries = 1;
 
diff --git a/deploy/install.sh b/deploy/install.sh
index 7e0a6bd..3fdf083 100755
--- a/deploy/install.sh
+++ b/deploy/install.sh
@@ -129,10 +129,21 @@ if [[ -d "$INSTALL_DIR/.git" ]]; then
 else
     log "Cloning into $INSTALL_DIR"
     install -d -o "$APP_USER" -g "$APP_USER" -m 0750 "$INSTALL_DIR"
-    # The token is used for this one command and never written to disk or into
-    # the git remote — later pulls use a deploy key or ask.
-    auth_url="${REPO_URL/https:\/\//https://oauth2:${GIT_TOKEN}@}"
-    as_app git clone --quiet --branch "$BRANCH" "$auth_url" "$INSTALL_DIR"
+
+    # The token goes through an askpass helper rather than into the URL: a URL
+    # with credentials shows up in the process list for every local user while
+    # the clone runs, and would end up in the remote afterwards.
+    askpass="$(mktemp)"
+    printf '#!/bin/sh\nprintf %%s "%s"\n' "$GIT_TOKEN" > "$askpass"
+    chmod 500 "$askpass"
+    chown "$APP_USER" "$askpass"
+    trap 'rm -f "$askpass"' EXIT
+
+    GIT_ASKPASS="$askpass" GIT_TERMINAL_PROMPT=0 \
+        as_app git clone --quiet --branch "$BRANCH" "${REPO_URL/https:\/\//https://oauth2@}" "$INSTALL_DIR"
+
+    rm -f "$askpass"
+    trap - EXIT
     as_app git -C "$INSTALL_DIR" remote set-url origin "$REPO_URL"
 fi
 cd "$INSTALL_DIR"
diff --git a/deploy/update.sh b/deploy/update.sh
index 4593bd8..cbe9ee0 100755
--- a/deploy/update.sh
+++ b/deploy/update.sh
@@ -114,15 +114,18 @@ in_app php artisan migrate --force
 log "Rebuilding assets"
 in_app npm run build
 
+# Before the restarts, not after: a service that starts while the old cache is
+# still on disk loads it and keeps those values for the life of its process.
+log "Clearing caches"
+in_app php artisan config:clear >/dev/null
+in_app php artisan view:clear >/dev/null
+
 log "Restarting services"
 docker compose up -d
 # Workers hold their PHP classes for the life of the process; without this they
 # keep running the code from before the update.
 docker compose restart queue queue-provisioning scheduler reverb
 
-in_app php artisan config:clear >/dev/null
-in_app php artisan view:clear >/dev/null
-
 log "Leaving maintenance mode"
 in_app php artisan up >/dev/null
 down=0