diff --git a/.github/workflows/phala-deploy.yml b/.github/workflows/phala-deploy.yml
index da1816a..af41ecc 100644
--- a/.github/workflows/phala-deploy.yml
+++ b/.github/workflows/phala-deploy.yml
@@ -221,16 +221,19 @@ jobs:
             --page-size 100 \
             --json \
             --api-key "$PHALA_API_KEY" > "$RUNNER_TEMP/phala-cvms.json"
-          existing_count="$(jq --arg name "$CVM_NAME" '[.items[] | select(.name == $name)] | length' "$RUNNER_TEMP/phala-cvms.json")"
+          # phala@1.1.20 emits normalized cvmName/appId, not raw name/id.
+          existing_count="$(jq --arg name "$CVM_NAME" '[.items[] | select(.cvmName == $name)] | length' "$RUNNER_TEMP/phala-cvms.json")"
           if [ "$existing_count" -gt 1 ]; then
             echo "::error::More than one Phala CVM is named $CVM_NAME"
             exit 1
           elif [ "$existing_count" -eq 1 ]; then
-            existing_id="$(jq -r --arg name "$CVM_NAME" '.items[] | select(.name == $name) | .id // empty' "$RUNNER_TEMP/phala-cvms.json")"
-            if [ -z "$existing_id" ]; then
-              echo "::error::Existing Phala CVM $CVM_NAME has no id"
+            existing_app_id="$(jq -r --arg name "$CVM_NAME" '.items[] | select(.cvmName == $name) | .appId // empty' "$RUNNER_TEMP/phala-cvms.json")"
+            if [[ ! "$existing_app_id" =~ ^[0-9a-f]{40}$ ]]; then
+              echo "::error::Existing Phala CVM $CVM_NAME has no valid app id"
               exit 1
             fi
+            # The CLI resolves app_<id> to the existing CVM; never use -n here.
+            existing_id="app_$existing_app_id"
             target=(--cvm-id "$existing_id")
           elif [ "$TARGET_ROLE" = "candidate" ]; then
             target=(-n "$CVM_NAME")
diff --git a/tests/workflows.test.mjs b/tests/workflows.test.mjs
index f1af347..b13ac48 100644
--- a/tests/workflows.test.mjs
+++ b/tests/workflows.test.mjs
@@ -352,7 +352,7 @@ test("Phala deployment is serialized and updates CVMs by id", () => {
   assert.equal(workflow.jobs.deploy.concurrency["cancel-in-progress"], true);
   assert.match(source, /existing_id=/);
   assert.match(source, /target=\(--cvm-id "\$existing_id"\)/);
-  assert.match(source, /has no id/);
+  assert.match(source, /has no valid app id/);
 });
 
 test("Phala never creates the release CVM", (t) => {
@@ -392,7 +392,8 @@ test("Phala never creates the release CVM", (t) => {
   );
   fs.writeFileSync(path.join(root, "phala-api-key"), "test-key");
 
-  const cvm = (name, id) => ({ name, id });
+  // phala@1.1.20 normalizes list output; it is not the raw CVM API shape.
+  const cvm = (cvmName, appId) => ({ cvmName, appId: appId.repeat(40) });
   const cases = [
     { role: "release", items: [], status: 1 },
     // A near-miss name is not the CVM; the search is a substring match.
@@ -400,6 +401,29 @@ test("Phala never creates the release CVM", (t) => {
     { role: "release", items: [cvm("service-production", "b")], status: 0 },
     { role: "candidate", items: [], status: 0 },
     { role: "candidate", items: [cvm("service-production", "c")], status: 0 },
+    {
+      role: "release",
+      items: [cvm("service-production", "b"), cvm("service-production", "c")],
+      status: 1,
+    },
+    { role: "release", items: [{ cvmName: "service-production" }], status: 1 },
+    {
+      role: "release",
+      items: [{ cvmName: "service-production", appId: "not-an-id" }],
+      status: 1,
+    },
+    {
+      role: "release",
+      items: [{ name: "service-production", id: "raw-api-id" }],
+      status: 1,
+    },
+    {
+      role: "release",
+      items: [
+        { cvmName: "service-production", appId: `${"a".repeat(40)}\ninvalid` },
+      ],
+      status: 1,
+    },
     // Anything that is not the candidate role is refused creation too.
     { role: "", items: [], status: 1 },
   ];
@@ -425,7 +449,9 @@ test("Phala never creates the release CVM", (t) => {
     });
     assert.equal(result.status, status, `${label}: ${result.stderr}`);
     const deploys = fs.readFileSync(deployLog, "utf8");
-    const existing = items.find((item) => item.name === "service-production");
+    const existing = items.find(
+      (item) => item.cvmName === "service-production",
+    );
 
     if (role !== "candidate") {
       // The release path never passes -n, whatever the lookup returned.
@@ -433,9 +459,17 @@ test("Phala never creates the release CVM", (t) => {
     }
     if (status !== 0) {
       assert.equal(deploys, "", `${label}: nothing may be deployed`);
-      assert.match(result.stdout, /::error::No Phala CVM is named/, label);
+      assert.match(
+        result.stdout,
+        /::error::(?:No Phala CVM is named|More than one Phala CVM|Existing Phala CVM .* has no valid app id)/,
+        label,
+      );
     } else if (existing) {
-      assert.match(deploys, new RegExp(`--cvm-id ${existing.id} `), label);
+      assert.match(
+        deploys,
+        new RegExp(`--cvm-id app_${existing.appId} `),
+        label,
+      );
       assert.doesNotMatch(deploys, /(^| )-n( |$)/m, label);
     } else {
       assert.match(deploys, /(^| )-n service-production /, label);