diff --git a/.gitea/workflows/deploy.yaml b/.gitea/workflows/deploy.yaml
index 3a6a71f5..11a1c9c8 100644
--- a/.gitea/workflows/deploy.yaml
+++ b/.gitea/workflows/deploy.yaml
@@ -11,69 +11,130 @@ concurrency:
 
 jobs:
   deploy:
-    runs-on: shell
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
 
     steps:
-      - name: Check out pushed commit
+      - name: Check out exact commit
         uses: actions/checkout@v4
         with:
           fetch-depth: 1
 
-      - name: Deploy AtomCMS
+      - name: Create release archive
         shell: bash
         run: |
           set -Eeuo pipefail
 
-          readonly APP_DIR="/var/www/atom-nexst"
-          readonly SOURCE_DIR="${GITHUB_WORKSPACE}"
+          git archive \
+            --format=tar.gz \
+            --output=atomcms-release.tar.gz \
+            HEAD
 
-          echo "--- Starting EPIC WEB CONTROL Deployment ---"
+          test -s atomcms-release.tar.gz
+          sha256sum atomcms-release.tar.gz > atomcms-release.tar.gz.sha256
 
-          test -n "$SOURCE_DIR"
-          test -d "$SOURCE_DIR/src"
-          test -f "$SOURCE_DIR/package.json"
-          test -f "$SOURCE_DIR/pnpm-lock.yaml"
+      - name: Upload release to VPS
+        uses: appleboy/scp-action@v0.1.7
+        with:
+          host: "172.20.2.1"
+          username: "root"
+          key: ${{ secrets.SSH_PRIVATE_KEY }}
+          port: 22
+          source: "atomcms-release.tar.gz,atomcms-release.tar.gz.sha256"
+          target: "/tmp"
+          overwrite: true
+          timeout: 120s
+          command_timeout: 10m
 
-          test -d "$APP_DIR"
-          test -f "$APP_DIR/.env"
-          test "$APP_DIR" = "/var/www/atom-nexst"
+      - name: Deploy through SSH
+        uses: appleboy/ssh-action@v1.0.3
+        with:
+          host: "172.20.2.1"
+          username: "root"
+          key: ${{ secrets.SSH_PRIVATE_KEY }}
+          port: 22
+          timeout: 120s
+          command_timeout: 25m
+          script: |
+            set -Eeuo pipefail
 
-          echo "--- Synchronizing Application Files ---"
+            readonly APP_DIR="/var/www/atom-nexst"
+            readonly RELEASE="/tmp/atomcms-release.tar.gz"
+            readonly CHECKSUM="/tmp/atomcms-release.tar.gz.sha256"
+            readonly BACKUP_DIR="/var/backups/atom-nexst"
+            readonly TIMESTAMP="$(date +%Y%m%d-%H%M%S)"
 
-          sudo rsync -a --delete \
-            --exclude=".git/" \
-            --exclude=".env" \
-            --exclude=".next/" \
-            --exclude="node_modules/" \
-            --exclude="storage/" \
-            --exclude="docs/" \
-            "$SOURCE_DIR/" "$APP_DIR/"
+            failure() {
+              local exit_code=$?
+              echo "--- DEPLOYMENT FAILED with code ${exit_code} ---"
+              systemctl status atom-nexst.service --no-pager || true
+              exit "$exit_code"
+            }
 
-          cd "$APP_DIR"
-          test "$PWD" = "$APP_DIR"
+            trap failure ERR
 
-          echo "--- Preparing pnpm ---"
-          sudo corepack enable
-          sudo corepack prepare pnpm@10.33.4 --activate
+            echo "--- Starting EPIC WEB CONTROL Deployment ---"
 
-          echo "--- Installing Locked Dependencies ---"
-          sudo pnpm install --frozen-lockfile --prod=false
+            test "$APP_DIR" = "/var/www/atom-nexst"
+            test -d "$APP_DIR"
+            test -f "$APP_DIR/.env"
+            test -s "$RELEASE"
+            test -s "$CHECKSUM"
 
-          echo "--- Generating Prisma Client ---"
-          sudo pnpm prisma:generate
+            cd /tmp
+            sha256sum --check "$CHECKSUM"
 
-          echo "--- Running Database Migrations ---"
-          sudo pnpm db:migrate
+            mkdir -p "$BACKUP_DIR"
 
-          echo "--- Building Application ---"
-          sudo rm -rf -- "$APP_DIR/.next"
-          sudo pnpm build
+            echo "--- Creating rollback backup ---"
+            tar \
+              --exclude=".next" \
+              --exclude="node_modules" \
+              --exclude="storage" \
+              --exclude=".env" \
+              -czf "$BACKUP_DIR/release-$TIMESTAMP.tar.gz" \
+              -C "$APP_DIR" .
 
-          echo "--- Restarting Atom Nexst Service ---"
-          sudo systemctl restart atom-nexst.service
-          sudo systemctl is-active --quiet atom-nexst.service
+            cd "$APP_DIR"
+            test "$PWD" = "$APP_DIR"
 
-          echo "--- Verifying Deployed Revision ---"
-          echo "DEPLOYED_COMMIT=${GITHUB_SHA}"
+            echo "--- Replacing tracked application files ---"
 
-          echo "--- Deployment Completed Successfully ---"
\ No newline at end of file
+            # These directories come entirely from Git.
+            # Persistent .env, storage and node_modules remain untouched.
+            rm -rf -- src public prisma scripts .gitea
+
+            tar -xzf "$RELEASE" -C "$APP_DIR"
+
+            rm -f -- "$RELEASE" "$CHECKSUM"
+
+            echo "--- Preparing pnpm ---"
+            corepack enable
+            corepack prepare pnpm@10.33.4 --activate
+
+            echo "--- Installing locked dependencies ---"
+            pnpm install --frozen-lockfile --prod=false
+
+            echo "--- Generating Prisma client ---"
+            pnpm prisma:generate
+
+            echo "--- Running database migrations ---"
+            pnpm db:migrate
+
+            echo "--- Building application ---"
+            rm -rf -- "$APP_DIR/.next"
+            pnpm build
+
+            echo "--- Restarting service ---"
+            systemctl restart atom-nexst.service
+            systemctl is-active --quiet atom-nexst.service
+
+            echo "--- Cleaning old backups ---"
+            find "$BACKUP_DIR" \
+              -maxdepth 1 \
+              -type f \
+              -name "release-*.tar.gz" \
+              -mtime +7 \
+              -delete
+
+            echo "--- Deployment Completed Successfully ---"
\ No newline at end of file