diff --git a/.gitea/workflows/cd.yml b/.gitea/workflows/cd.yml
index 6570c00..8e1bc18 100644
--- a/.gitea/workflows/cd.yml
+++ b/.gitea/workflows/cd.yml
@@ -146,13 +146,12 @@ jobs:
           ssh -i ~/.ssh/id_ed25519 \
             "${{ secrets.DEPLOY_USER }}@${{ secrets.DEPLOY_HOST }}" bash -euo pipefail <<'EOF'
             cd /opt/vigilcare
-            set -a
-            # shellcheck disable=SC1091
-            . ./.env
-            set +a
-            API_PORT="${API_PORT:-5270}"
-            GATEWAY_PORT="${GATEWAY_PORT:-5081}"
-            DASHBOARD_PORT="${DASHBOARD_PORT:-8080}"
+            # Do not `source` .env — compose env files are not bash (semicolons,
+            # spaces in "SSL Mode=...", CRLF). Read only the host ports we need.
+            env_val() { sed -n "s/^${1}=//p" .env | tail -n1 | tr -d '\r'; }
+            API_PORT="$(env_val API_PORT)"; API_PORT="${API_PORT:-5270}"
+            GATEWAY_PORT="$(env_val GATEWAY_PORT)"; GATEWAY_PORT="${GATEWAY_PORT:-5081}"
+            DASHBOARD_PORT="$(env_val DASHBOARD_PORT)"; DASHBOARD_PORT="${DASHBOARD_PORT:-8080}"
 
             for i in $(seq 1 30); do
               if curl -fsS "http://localhost:${API_PORT}/health/ready" >/dev/null; then