diff --git a/.gitea/workflows/deploy-env.yml b/.gitea/workflows/deploy-env.yml
index b2f52c7..180144a 100644
--- a/.gitea/workflows/deploy-env.yml
+++ b/.gitea/workflows/deploy-env.yml
@@ -84,21 +84,33 @@ jobs:
           ssh-keyscan -H "${{ vars[inputs.host-var] }}" >> ~/.ssh/known_hosts 2>/dev/null
 
       - name: Pre-deploy
-        if: ${{ inputs.pre-deploy-cmd != '' }}
         run: |
-          ssh ${DEPLOY_USER}@${{ vars[inputs.host-var] }} "export GPG_TTY=$(tty)"
+          HOST="${{ vars[inputs.host-var] }}"
           REMOTE_PATH="${DEPLOY_BASE_PATH}/${{ github.repository_owner }}/${{ github.event.repository.name }}"
-          ssh ${DEPLOY_USER}@${{ vars[inputs.host-var] }} "a2dissite ${{ github.event.repository.name }}.site-ssl -q"
-          ssh ${DEPLOY_USER}@${{ vars[inputs.host-var] }} "service apache2 reload"
-          [ -f "$APACHE" ] && ssh ${DEPLOY_USER}@${{ vars[inputs.host-var] }} "cp -v /etc/apache2/sites-available/${{ github.event.repository.name }}.site-ssl.conf /etc/apache2/sites-available/${{ github.event.repository.name }}.site-ssl.conf_$(date +%s)"
-          [ -f "$APACHE" ] && ssh ${DEPLOY_USER}@${{ vars[inputs.host-var] }} "cp -v ${REMOTE_PATH}/apache-${ENV_NAME}.conf /etc/apache2/sites-available/${{ github.event.repository.name }}.site-ssl.conf"
-          ssh ${DEPLOY_USER}@${{ vars[inputs.host-var] }} "${{ inputs.pre-deploy-cmd }}"
+          APACHE="apache-${ENV_NAME}.conf"
+          SITE_NAME="${{ github.event.repository.name }}.site-ssl"
+
+          # Comandi standard (sempre eseguiti)
+          ssh ${DEPLOY_USER}@${HOST} "a2dissite ${SITE_NAME} -q || true"
+          ssh ${DEPLOY_USER}@${HOST} "service apache2 reload"
+          if [ -f "$APACHE" ]; then
+            ssh ${DEPLOY_USER}@${HOST} "cp -v /etc/apache2/sites-available/${SITE_NAME}.conf /etc/apache2/sites-available/${SITE_NAME}.conf_\$(date +%s)" || true
+            ssh ${DEPLOY_USER}@${HOST} "cp -v ${REMOTE_PATH}/${APACHE} /etc/apache2/sites-available/${SITE_NAME}.conf"
+          fi
+
+          # Comando custom (solo se fornito)
+          if [ -n "${{ inputs.pre-deploy-cmd }}" ]; then
+            ssh ${DEPLOY_USER}@${HOST} "${{ inputs.pre-deploy-cmd }}"
+          fi
 
       - name: Docker login sul server
         run: |
           HOST="${{ vars[inputs.host-var] }}"
-          ssh ${DEPLOY_USER}@${HOST} \
-            "echo '${{ secrets.MAVEN_PASSWORD }}' | docker login ${{ vars.DOCKER_REGISTRY }} -u '${{ secrets.MAVEN_USERNAME }}' --password-stdin"
+          REGISTRY="${{ vars.DOCKER_REGISTRY }}"
+          AUTH=$(echo -n "${{ secrets.MAVEN_USERNAME }}:${{ secrets.MAVEN_PASSWORD }}" | base64 -w0)
+
+          # Scrive config.json direttamente, senza passare per docker login / credential helper
+          ssh ${DEPLOY_USER}@${HOST} "mkdir -p /tmp/.docker-ci && echo '{\"auths\":{\"${REGISTRY}\":{\"auth\":\"${AUTH}\"}}}' > /tmp/.docker-ci/config.json"
 
       - name: Deploy
         run: |
@@ -118,20 +130,27 @@ jobs:
 
           scp ${FILES_TO_COPY} ${DEPLOY_USER}@${HOST}:${REMOTE_PATH}/
 
-          # Componi il comando docker compose
-          COMPOSE_CMD="cd ${REMOTE_PATH} && docker compose -f ${COMPOSE}"
+          # Pull e up con DOCKER_CONFIG per evitare GPG
+          COMPOSE_CMD="cd ${REMOTE_PATH} && DOCKER_CONFIG=/tmp/.docker-ci docker compose -f ${COMPOSE}"
           [ -f "$ENV_FILE" ] && COMPOSE_CMD="${COMPOSE_CMD} --env-file ${ENV_FILE}"
           COMPOSE_CMD="${COMPOSE_CMD} pull && ${COMPOSE_CMD} up -d ${{ inputs.compose-opts }}"
 
           ssh ${DEPLOY_USER}@${HOST} "${COMPOSE_CMD}"
 
       - name: Post-deploy
-        if: ${{ inputs.post-deploy-cmd != '' }}
         run: |
-          ssh ${DEPLOY_USER}@${{ vars[inputs.host-var] }} "a2ensite ${{ github.event.repository.name }}.site-ssl -q"
-          ssh ${DEPLOY_USER}@${{ vars[inputs.host-var] }} "service apache2 reload"
-          ssh ${DEPLOY_USER}@${{ vars[inputs.host-var] }} "docker image prune -a -f"
-          ssh ${DEPLOY_USER}@${{ vars[inputs.host-var] }} "${{ inputs.post-deploy-cmd }}"
+          HOST="${{ vars[inputs.host-var] }}"
+          SITE_NAME="${{ github.event.repository.name }}.site-ssl"
+
+          # Comandi standard (sempre eseguiti)
+          ssh ${DEPLOY_USER}@${HOST} "a2ensite ${SITE_NAME} -q"
+          ssh ${DEPLOY_USER}@${HOST} "service apache2 reload"
+          ssh ${DEPLOY_USER}@${HOST} "DOCKER_CONFIG=/tmp/.docker-ci docker image prune -a -f"
+
+          # Comando custom (solo se fornito)
+          if [ -n "${{ inputs.post-deploy-cmd }}" ]; then
+            ssh ${DEPLOY_USER}@${HOST} "${{ inputs.post-deploy-cmd }}"
+          fi
 
       - name: Verifica container
         run: |
@@ -140,8 +159,11 @@ jobs:
           COMPOSE="docker-compose-${ENV_NAME}.yml"
           ENV_FILE=".env_${ENV_NAME}"
 
-          COMPOSE_CMD="cd ${REMOTE_PATH} && docker compose -f ${COMPOSE}"
+          COMPOSE_CMD="cd ${REMOTE_PATH} && DOCKER_CONFIG=/tmp/.docker-ci docker compose -f ${COMPOSE}"
           [ -f "$ENV_FILE" ] && COMPOSE_CMD="${COMPOSE_CMD} --env-file ${ENV_FILE}"
 
           echo "── Container status ──"
           ssh ${DEPLOY_USER}@${HOST} "${COMPOSE_CMD} ps"
+
+          # Cleanup config temporaneo
+          ssh ${DEPLOY_USER}@${HOST} "rm -rf /tmp/.docker-ci"