might want to tag with `-deploy` here?  We typically run deploys with "--tags=deploy" and I wonder if an untagged handler runs or not.