diff --git a/.gitea/workflows/deploy.yml b/.gitea/workflows/deploy.yml
index ab18f314..7ee7a714 100644
--- a/.gitea/workflows/deploy.yml
+++ b/.gitea/workflows/deploy.yml
@@ -443,13 +443,8 @@ jobs:
           scp .env.deploy root@alpha.mintel.me:$SITE_DIR/$ENV_FILE
           scp docker-compose.yml root@alpha.mintel.me:$SITE_DIR/docker-compose.yml
           
-          # Execute remote commands via Heredoc to ensure local variables are expanded
-          ssh root@alpha.mintel.me <<EOF
-            cd $SITE_DIR
-            echo "$REGISTRY_PASS" | docker login git.infra.mintel.me -u "$REGISTRY_USER" --password-stdin
-            docker compose -p "${{ needs.prepare.outputs.project_name }}" --env-file "$ENV_FILE" pull
-            docker compose -p "${{ needs.prepare.outputs.project_name }}" --env-file "$ENV_FILE" up -d --remove-orphans
-EOF
+          # Execute remote commands
+          ssh root@alpha.mintel.me "cd $SITE_DIR && echo \"$REGISTRY_PASS\" | docker login git.infra.mintel.me -u \"$REGISTRY_USER\" --password-stdin && docker compose -p \"${{ needs.prepare.outputs.project_name }}\" --env-file \"$ENV_FILE\" pull && docker compose -p \"${{ needs.prepare.outputs.project_name }}\" --env-file \"$ENV_FILE\" up -d --remove-orphans"
           
           # Sanitize Payload Migrations: Replace 'dev' push entries with proper migration names.
           # Without this, Payload prompts interactively for confirmation and blocks forever in Docker.
@@ -481,18 +476,16 @@ EOF
           done
 
           if [ -n "$VALUES" ]; then
-            ssh root@alpha.mintel.me <<EOF
-              docker exec $DB_CONTAINER psql -U $REMOTE_DB_USER -d $REMOTE_DB_NAME -c "
-                DO \\\$\\\$ BEGIN
-                  DELETE FROM payload_migrations WHERE batch = -1;
-                  INSERT INTO payload_migrations (name, batch)
-                  SELECT name, batch FROM (VALUES $VALUES) AS v(name, batch)
-                  WHERE NOT EXISTS (SELECT 1 FROM payload_migrations pm WHERE pm.name = v.name);
-                EXCEPTION WHEN undefined_table THEN
-                  RAISE NOTICE 'payload_migrations table does not exist yet — skipping sanitization';
-                END \\\$\\\$;
-              "
-EOF
+            echo "
+              DO \$\$ BEGIN
+                DELETE FROM payload_migrations WHERE batch = -1;
+                INSERT INTO payload_migrations (name, batch)
+                SELECT name, batch FROM (VALUES $VALUES) AS v(name, batch)
+                WHERE NOT EXISTS (SELECT 1 FROM payload_migrations pm WHERE pm.name = v.name);
+              EXCEPTION WHEN undefined_table THEN
+                RAISE NOTICE 'payload_migrations table does not exist yet — skipping sanitization';
+              END \$\$;
+            " | ssh root@alpha.mintel.me "docker exec -i $DB_CONTAINER psql -U $REMOTE_DB_USER -d $REMOTE_DB_NAME"
           fi
           
           # Restart app to pick up clean migration state