diff --git a/.gitea/workflows/deploy.yaml b/.gitea/workflows/deploy.yaml
index 28dc44ef36..e0392f7ad1 100644
--- a/.gitea/workflows/deploy.yaml
+++ b/.gitea/workflows/deploy.yaml
@@ -1,49 +1,100 @@
 name: Local Build and Deploy
+
 on:
   push:
     branches:
       - main
+
+concurrency:
+  group: atom-nexst-production
+  cancel-in-progress: false
+
 jobs:
   deploy:
     runs-on: shell
+    timeout-minutes: 20
+
     steps:
       - name: Run Deploy Scripts Locally
+        shell: bash
         run: |
-          set -e
-          echo "--- EPIC WEB CONTROL: Starting Auto-Cleanup & Deploy ---"
-          
-          # 1. Clean up unused build images safely
-          docker image prune -f
-          
-          # 2. Navigate to your website directory
-          cd /var/www/atom-nexst/
-          
-          # Point Git directly to the local Gitea folder path
-          git remote set-url origin /docker/gitea/gitea/git/repositories/remco/epicnext-cms.git/
-          
-          # 3. Fetch and update code
-          git fetch origin --prune
-          git reset --hard origin/main
-          
-          # 4. Configure pnpm and build
-          pnpm config set trusted-dependencies @parcel/watcher,@swc/core,sharp
-          pnpm install --frozen-lockfile
-          pnpm db:migrate
-          pnpm prisma generate
-          pnpm build
-          
-          # 5. Fix ownership: Ensure files are web-server accessible after building
-          sudo chown -R www-data:www-data /var/www/atom-nexst/
-          
-          # 6. Restart and verify the application service
-          echo "Restarting service..."
-          sudo systemctl restart atom-nexst.service
-          
-          # Wait 2 seconds and check if the service is actually running smoothly
-          sleep 2
-          if ! systemctl is-active --quiet atom-nexst.service; then
-            echo "ERROR: atom-nexst.service failed to start!" >&2
+          set -Eeuo pipefail
+
+          APP_DIR="/var/www/atom-nexst"
+          SERVICE_NAME="atom-nexst.service"
+          REPOSITORY="/docker/gitea/gitea/git/repositories/remco/epicnext-cms.git"
+          LOCK_FILE="/tmp/atom-nexst-deploy.lock"
+          HEALTH_URL="http://127.0.0.1:3000/api/health"
+
+          echo "--- EPIC WEB CONTROL: Starting Deploy ---"
+
+          exec 9>"$LOCK_FILE"
+
+          if ! flock -n 9; then
+            echo "ERROR: Another deployment is already running."
             exit 1
           fi
-          
-          echo "--- Deployment successfully completed ---"
\ No newline at end of file
+
+          if [ ! -d "$APP_DIR/.git" ]; then
+            echo "ERROR: $APP_DIR is not a Git repository."
+            exit 1
+          fi
+
+          cd "$APP_DIR"
+
+          git remote set-url origin "$REPOSITORY"
+          git fetch origin main --prune
+          git reset --hard origin/main
+
+          test -f package.json
+          test -f pnpm-lock.yaml
+
+          corepack enable
+          corepack prepare pnpm@10.33.4 --activate
+
+          sudo chown -R www-data:www-data "$APP_DIR"
+
+          sudo -u www-data env HOME=/var/www \
+            pnpm install --frozen-lockfile
+
+          sudo -u www-data env HOME=/var/www \
+            pnpm prisma:generate
+
+          sudo -u www-data env HOME=/var/www \
+            pnpm typecheck
+
+          sudo -u www-data env HOME=/var/www \
+            pnpm test
+
+          sudo -u www-data env HOME=/var/www \
+            pnpm build
+
+          sudo -u www-data env HOME=/var/www \
+            pnpm db:migrate
+
+          sudo systemctl restart "$SERVICE_NAME"
+
+          if ! sudo systemctl is-active --quiet "$SERVICE_NAME"; then
+            echo "ERROR: $SERVICE_NAME failed to start."
+            sudo journalctl -u "$SERVICE_NAME" -n 100 --no-pager
+            exit 1
+          fi
+
+          for attempt in $(seq 1 15); do
+            if curl \
+              --fail \
+              --silent \
+              --show-error \
+              --max-time 5 \
+              "$HEALTH_URL" >/dev/null; then
+              echo "--- Deployment successfully completed ---"
+              exit 0
+            fi
+
+            echo "Waiting for application startup ($attempt/15)..."
+            sleep 2
+          done
+
+          echo "ERROR: Application health check failed."
+          sudo journalctl -u "$SERVICE_NAME" -n 100 --no-pager
+          exit 1