diff --git a/.gitea/workflows/deploy.yml b/.gitea/workflows/deploy.yml
index 0f31dd7a..d0ce5049 100644
--- a/.gitea/workflows/deploy.yml
+++ b/.gitea/workflows/deploy.yml
@@ -366,14 +366,18 @@ jobs:
           else
             SITE_DIR="/home/deploy/sites/branch.klz-cables.com/${SLUG:-unknown}"
           fi
+          # Transfer files
           ssh root@alpha.mintel.me "mkdir -p $SITE_DIR"
-          
           scp .env.deploy root@alpha.mintel.me:$SITE_DIR/$ENV_FILE
           scp docker-compose.yml root@alpha.mintel.me:$SITE_DIR/docker-compose.yml
           
-          ssh root@alpha.mintel.me "cd $SITE_DIR && echo '$REGISTRY_PASS' | docker login git.infra.mintel.me -u '$REGISTRY_USER' --password-stdin"
-          ssh root@alpha.mintel.me "cd $SITE_DIR && docker compose -p '${{ needs.prepare.outputs.project_name }}' --env-file '$ENV_FILE' pull"
-          ssh root@alpha.mintel.me "cd $SITE_DIR && docker compose -p '${{ needs.prepare.outputs.project_name }}' --env-file '$ENV_FILE' up -d --remove-orphans"
+          # Execute remote commands via Heredoc to ensure local variables are expanded
+          ssh root@alpha.mintel.me <<EOF
+            cd $SITE_DIR
+            echo "$REGISTRY_PASS" | docker login git.infra.mintel.me -u "$REGISTRY_USER" --password-stdin
+            docker compose -p "${{ needs.prepare.outputs.project_name }}" --env-file "$ENV_FILE" pull
+            docker compose -p "${{ needs.prepare.outputs.project_name }}" --env-file "$ENV_FILE" up -d --remove-orphans
+EOF
           
           # Sanitize Payload Migrations: Replace 'dev' push entries with proper migration names.
           # Without this, Payload prompts interactively for confirmation and blocks forever in Docker.
@@ -405,22 +409,23 @@ jobs:
           done
 
           if [ -n "$VALUES" ]; then
-            ssh root@alpha.mintel.me "docker exec $DB_CONTAINER psql -U $REMOTE_DB_USER -d $REMOTE_DB_NAME -c \"
-              DO \\\$\\\$ BEGIN
-                DELETE FROM payload_migrations WHERE batch = -1;
-                INSERT INTO payload_migrations (name, batch)
-                SELECT name, batch FROM (VALUES $VALUES) AS v(name, batch)
-                WHERE NOT EXISTS (SELECT 1 FROM payload_migrations pm WHERE pm.name = v.name);
-              EXCEPTION WHEN undefined_table THEN
-                RAISE NOTICE 'payload_migrations table does not exist yet — skipping sanitization';
-              END \\\$\\\$;
-            \"" || echo "⚠️  Migration sanitization skipped (table may not exist yet)"
+            ssh root@alpha.mintel.me <<EOF
+              docker exec $DB_CONTAINER psql -U $REMOTE_DB_USER -d $REMOTE_DB_NAME -c "
+                DO \\\$\\\$ BEGIN
+                  DELETE FROM payload_migrations WHERE batch = -1;
+                  INSERT INTO payload_migrations (name, batch)
+                  SELECT name, batch FROM (VALUES $VALUES) AS v(name, batch)
+                  WHERE NOT EXISTS (SELECT 1 FROM payload_migrations pm WHERE pm.name = v.name);
+                EXCEPTION WHEN undefined_table THEN
+                  RAISE NOTICE 'payload_migrations table does not exist yet — skipping sanitization';
+                END \\\$\\\$;
+              "
+EOF
           fi
           
           # Restart app to pick up clean migration state
           APP_CONTAINER="${{ needs.prepare.outputs.project_name }}-klz-app-1"
           ssh root@alpha.mintel.me "docker restart $APP_CONTAINER"
-          
           ssh root@alpha.mintel.me "docker system prune -f --filter 'until=24h'"
 
       - name: 🧹 Post-Deploy Cleanup (Runner)