CI passed but the deployed code was different. How did source control cause that?

A CI pipeline showed green while production ran different code than what was tested. The root cause was not pinning the commit hash during deployment — a late push changed the code after CI ran but before deploy pulled it. The fix is to pin commits explicitly in the deploy step to ensure deterministic builds.