diff --git a/.gitea/workflows/cd.yml b/.gitea/workflows/cd.yml
index bda1a89..76a73ea 100644
--- a/.gitea/workflows/cd.yml
+++ b/.gitea/workflows/cd.yml
@@ -97,24 +97,32 @@ jobs:
 
       # Runs while the previous release is still serving traffic, so every
       # migration must be backwards-compatible with the outgoing image
-      # (expand-then-contract).
+      # (expand-then-contract). Connection strings contain `;` / spaces
+      # ("SSL Mode=...") — never pass them as a bare ssh remote argv; the
+      # remote shell splits on `;` and drops the variable (set -u → unbound).
       - name: Apply migrations
         env:
           PG_CONNECTION_DDL: ${{ secrets.PG_CONNECTION_DDL }}
         run: |
+          REMOTE="${{ secrets.DEPLOY_USER }}@${{ secrets.DEPLOY_HOST }}"
           scp -i ~/.ssh/id_ed25519 ./migrate-api \
-            "${{ secrets.DEPLOY_USER }}@${{ secrets.DEPLOY_HOST }}:/tmp/vigilcare-records-migrate-api"
-          ssh -i ~/.ssh/id_ed25519 \
-            "${{ secrets.DEPLOY_USER }}@${{ secrets.DEPLOY_HOST }}" \
-            PG_CONNECTION_DDL="$PG_CONNECTION_DDL" bash -euo pipefail <<'EOF'
+            "$REMOTE:/tmp/vigilcare-records-migrate-api"
+          umask 077
+          printf '%s\n' "$PG_CONNECTION_DDL" > /tmp/vigilcare-records-pg-ddl
+          scp -i ~/.ssh/id_ed25519 /tmp/vigilcare-records-pg-ddl \
+            "$REMOTE:/tmp/vigilcare-records-pg-ddl"
+          rm -f /tmp/vigilcare-records-pg-ddl
+          ssh -i ~/.ssh/id_ed25519 "$REMOTE" bash -euo pipefail <<'EOF'
             chmod +x /tmp/vigilcare-records-migrate-api
+            chmod 600 /tmp/vigilcare-records-pg-ddl
+            PG_CONNECTION_DDL="$(cat /tmp/vigilcare-records-pg-ddl)"
             docker run --rm \
               --network shared-services \
               -v /tmp/vigilcare-records-migrate-api:/migrate-api:ro \
               --entrypoint /migrate-api \
               mcr.microsoft.com/dotnet/runtime-deps:8.0 \
               --connection "$PG_CONNECTION_DDL"
-            rm -f /tmp/vigilcare-records-migrate-api
+            rm -f /tmp/vigilcare-records-migrate-api /tmp/vigilcare-records-pg-ddl
           EOF
 
   deploy: