diff --git a/.gitea/workflows/deploy-prod.yml b/.gitea/workflows/deploy-prod.yml
index 927baca4..26be55c2 100644
--- a/.gitea/workflows/deploy-prod.yml
+++ b/.gitea/workflows/deploy-prod.yml
@@ -32,10 +32,15 @@ jobs:
     steps:
       - name: Verify SSH Key and Secrets
         run: |
+          # SSH_PRIVATE_KEY is the actual secret name registered in this repo
+          # (verified via GET /repos/{r}/actions/secrets -- DEPLOY_SSH_KEY_B64 /
+          # DEPLOY_SSH_KEY were never actually created despite CLAUDE.md
+          # claiming so; kept as fallback names in case they're added later).
+          SSH_KEY="${{ secrets.SSH_PRIVATE_KEY }}"
           SSH_KEY_B64="${{ secrets.DEPLOY_SSH_KEY_B64 }}"
           SSH_KEY_RAW="${{ secrets.DEPLOY_SSH_KEY }}"
-          if [ -z "$SSH_KEY_B64" ] && [ -z "$SSH_KEY_RAW" ]; then
-            echo "ERROR: DEPLOY_SSH_KEY_B64 or DEPLOY_SSH_KEY not configured"
+          if [ -z "$SSH_KEY" ] && [ -z "$SSH_KEY_B64" ] && [ -z "$SSH_KEY_RAW" ]; then
+            echo "ERROR: No SSH key secret configured (checked SSH_PRIVATE_KEY, DEPLOY_SSH_KEY_B64, DEPLOY_SSH_KEY)"
             exit 1
           fi
           [ -z "${{ secrets.GITEA_TOKEN }}" ] && { echo "ERROR: GITEA_TOKEN not configured"; exit 1; }
@@ -104,17 +109,25 @@ jobs:
       - name: Setup SSH
         run: |
           mkdir -p ~/.ssh
+          SSH_KEY="${{ secrets.SSH_PRIVATE_KEY }}"
           SSH_KEY_B64="${{ secrets.DEPLOY_SSH_KEY_B64 }}"
           SSH_KEY_RAW="${{ secrets.DEPLOY_SSH_KEY }}"
 
-          if [ -n "$SSH_KEY_B64" ]; then
+          write_key() {
+            # $1 = raw secret value; auto-detects PEM vs base64
+            if printf '%s' "$1" | grep -q 'BEGIN.*PRIVATE KEY'; then
+              printf '%b\n' "$1" > ~/.ssh/deploy_key
+            else
+              printf '%s' "$1" | base64 -d > ~/.ssh/deploy_key
+            fi
+          }
+
+          if [ -n "$SSH_KEY" ]; then
+            write_key "$SSH_KEY"
+          elif [ -n "$SSH_KEY_B64" ]; then
             printf '%s' "$SSH_KEY_B64" | base64 -d > ~/.ssh/deploy_key
           elif [ -n "$SSH_KEY_RAW" ]; then
-            if printf '%s' "$SSH_KEY_RAW" | grep -q 'BEGIN.*PRIVATE KEY'; then
-              printf '%b\n' "$SSH_KEY_RAW" > ~/.ssh/deploy_key
-            else
-              printf '%s' "$SSH_KEY_RAW" | base64 -d > ~/.ssh/deploy_key
-            fi
+            write_key "$SSH_KEY_RAW"
           else
             echo "ERROR: No SSH key configured"
             exit 1
@@ -207,10 +220,17 @@ jobs:
       - name: Setup SSH (for service check)
         run: |
           mkdir -p ~/.ssh
+          SSH_KEY="${{ secrets.SSH_PRIVATE_KEY }}"
           SSH_KEY_B64="${{ secrets.DEPLOY_SSH_KEY_B64 }}"
           SSH_KEY_RAW="${{ secrets.DEPLOY_SSH_KEY }}"
 
-          if [ -n "$SSH_KEY_B64" ]; then
+          if [ -n "$SSH_KEY" ]; then
+            if printf '%s' "$SSH_KEY" | grep -q 'BEGIN.*PRIVATE KEY'; then
+              printf '%b\n' "$SSH_KEY" > ~/.ssh/deploy_key
+            else
+              printf '%s' "$SSH_KEY" | base64 -d > ~/.ssh/deploy_key
+            fi
+          elif [ -n "$SSH_KEY_B64" ]; then
             printf '%s' "$SSH_KEY_B64" | base64 -d > ~/.ssh/deploy_key
           elif [ -n "$SSH_KEY_RAW" ]; then
             printf '%s' "$SSH_KEY_RAW" | base64 -d > ~/.ssh/deploy_key