diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml
index 415d5f1..c46ab43 100644
--- a/.github/workflows/deploy.yml
+++ b/.github/workflows/deploy.yml
@@ -44,6 +44,12 @@ jobs:
           SCP_CMD="scp -o StrictHostKeyChecking=no -i ~/.ssh/deploy_key"
           DEPLOY_DIR="/mnt/user/appdata/nuzlocke-tracker"
 
+          # Write .env from secrets (overwrites any existing file)
+          printf '%s\n' \
+            "POSTGRES_PASSWORD=${{ secrets.POSTGRES_PASSWORD }}" \
+            "SUPABASE_JWT_SECRET=${{ secrets.SUPABASE_JWT_SECRET }}" \
+          | $SSH_CMD "cat > '${DEPLOY_DIR}/.env'"
+
           $SCP_CMD docker-compose.prod.yml "root@192.168.1.10:${DEPLOY_DIR}/docker-compose.yml"
           $SCP_CMD backup.sh "root@192.168.1.10:${DEPLOY_DIR}/backup.sh"
           $SSH_CMD "chmod +x '${DEPLOY_DIR}/backup.sh'"