diff --git a/scripts/git-build-deploy.ps1 b/scripts/git-build-deploy.ps1
index 4db7250..dff7779 100644
--- a/scripts/git-build-deploy.ps1
+++ b/scripts/git-build-deploy.ps1
@@ -205,6 +205,23 @@ foreach ($entry in $replacements.GetEnumerator()) {
 }
 $remoteScript = $remoteScript.Replace("`r`n", "`n")
 
+# Freeze production-script bytes locally before crossing PowerShell, Bash, and SSH.
+$productionBlockPatternText = '(?ms)^production_script="\$\(cat <<' + [char]39 + 'PRODUCTION' + [char]39 + '\n(?<body>.*?)\nPRODUCTION\n\)"\n\nproduction_script_base64=.*?$'
+$productionBlockPattern = [regex]$productionBlockPatternText
+$productionBlockMatch = $productionBlockPattern.Match($remoteScript)
+if (-not $productionBlockMatch.Success) {
+    throw 'Cannot extract the production deployment script; release aborted.'
+}
+$productionScriptBytes = [System.Text.Encoding]::UTF8.GetBytes(
+    $productionBlockMatch.Groups['body'].Value + "`n"
+)
+$productionScriptBase64 = [Convert]::ToBase64String($productionScriptBytes)
+$productionBlockReplacement = "production_script_base64=$(ConvertTo-ShellSingleQuoted $productionScriptBase64)"
+$remoteScript = $remoteScript.Remove(
+    $productionBlockMatch.Index,
+    $productionBlockMatch.Length
+).Insert($productionBlockMatch.Index, $productionBlockReplacement)
+
 $localTemp = Join-Path ([System.IO.Path]::GetTempPath()) ("yyd-notification-deploy-{0}.sh" -f [guid]::NewGuid().ToString('N'))
 $remoteTemp = "/tmp/$(Split-Path $localTemp -Leaf)"
 try {