diff --git a/deploy/deploy.sh b/deploy/deploy.sh
index b92bdcb..88387e7 100755
--- a/deploy/deploy.sh
+++ b/deploy/deploy.sh
@@ -239,15 +239,20 @@ if ! run_artisan "migrate --force"; then
 fi
 
 switch_current_release() {
+  # Remove a root-owned symlink left from manual bootstrap so deploy can replace it.
+  if [ -e "$CURRENT_LINK" ] || [ -L "$CURRENT_LINK" ]; then
+    rm -f "$CURRENT_LINK" 2>/dev/null || true
+  fi
+
   if ln -sfnT "$NEW_RELEASE" "$CURRENT_LINK" 2>/dev/null; then
     return 0
   fi
 
-  if command -v sudo >/dev/null 2>&1 && sudo -n ln -sfnT "$NEW_RELEASE" "$CURRENT_LINK"; then
+  if command -v sudo >/dev/null 2>&1 && sudo -n rm -f "$CURRENT_LINK" && sudo -n ln -sfnT "$NEW_RELEASE" "$CURRENT_LINK"; then
     return 0
   fi
 
-  echo "Unable to update current release symlink at $CURRENT_LINK" >&2
+  echo "Unable to update current release symlink at $CURRENT_LINK (ensure $APP_ROOT is owned by the deploy user)" >&2
   return 1
 }
 
diff --git a/deployment/sudoers.ladill-care-deploy.example b/deployment/sudoers.ladill-care-deploy.example
new file mode 100644
index 0000000..729caaf
--- /dev/null
+++ b/deployment/sudoers.ladill-care-deploy.example
@@ -0,0 +1,3 @@
+# Allow the deploy user to switch ladill-care releases without a password.
+# Required only if APP_ROOT was bootstrapped as root (e.g. manual first deploy).
+deploy ALL=(ALL) NOPASSWD: /bin/ln -sfnT /var/www/ladill-care/releases/* /var/www/ladill-care/current, /bin/rm -f /var/www/ladill-care/current