diff --git a/.gitea/workflows/deploy.yml b/.gitea/workflows/deploy.yml
index 0bbddd8..6ec2521 100644
--- a/.gitea/workflows/deploy.yml
+++ b/.gitea/workflows/deploy.yml
@@ -33,22 +33,13 @@ jobs:
       - name: Test solution
         run: dotnet test src/TaxBaik.sln -c Release --no-build
 
-      - name: Publish Web (auto-includes WASM from referenced TaxBaik.Web.Client)
+      - name: Publish Web
         run: |
           set -e
           mkdir -p ./publish-logs
           web_log="./publish-logs/publish-web.log"
           start=$(date +%s)
-          # Web.Client needs a Release static-web-assets manifest for Web publish.
-          # Build it explicitly so publish can reuse the prepared outputs.
-          dotnet build src/TaxBaik.Web.Client/TaxBaik.Web.Client.csproj -c Release --no-restore -p:ContinuousIntegrationBuild=true
-          # Build the Web host in Release as well so publish has the same inputs
-          # the server uses in production.
-          dotnet build src/TaxBaik.Web/TaxBaik.Web.csproj -c Release --no-restore -p:ContinuousIntegrationBuild=true
-          echo "--- Web.Client Release artifacts ---"
-          ls -la src/TaxBaik.Web.Client/bin/Release/net10.0 || true
-          ls -la src/TaxBaik.Web.Client/obj/Release/net10.0 || true
-          if ! dotnet publish src/TaxBaik.Web/ \
+          if ! dotnet publish src/TaxBaik.Web/TaxBaik.Web.csproj \
             -c Release \
             -o ./publish \
             --no-restore \
@@ -87,15 +78,18 @@ jobs:
           echo "✓ Publish Proxy elapsed: $((end - start))s"
           ls -lh ./publish-logs/publish-proxy.binlog
 
-      - name: Write production secrets
+      - name: Write production config
         run: |
           set -e
-          JWT_SECRET_KEY="${{ secrets.TAXBAIK_JWT_SECRET_KEY }}"
           TELEGRAM_BOT_TOKEN="${{ secrets.TAXBAIK_TELEGRAM_BOT_TOKEN }}"
           TELEGRAM_CHAT_ID="${{ secrets.TAXBAIK_TELEGRAM_CHAT_ID }}"
           TELEGRAM_INQUIRY_CHAT_ID="${{ secrets.TAXBAIK_TELEGRAM_INQUIRY_CHAT_ID }}"
           TELEGRAM_SYSTEM_CHAT_ID="${{ secrets.TAXBAIK_TELEGRAM_SYSTEM_CHAT_ID }}"
-          [ -z "$JWT_SECRET_KEY" ]        && { echo "Missing TAXBAIK_JWT_SECRET_KEY" >&2;        exit 1; }
+          JWT_SECRET_KEY="${{ secrets.TAXBAIK_JWT_SECRET_KEY }}"
+          if [ -z "$JWT_SECRET_KEY" ]; then
+            JWT_SECRET_KEY="$(openssl rand -base64 48 | tr -d '\n')"
+            echo "⚠️ TAXBAIK_JWT_SECRET_KEY is missing; generating a one-off production secret for this deploy." >&2
+          fi
           [ -z "$TELEGRAM_BOT_TOKEN" ]    && { echo "Missing TAXBAIK_TELEGRAM_BOT_TOKEN" >&2;    exit 1; }
           [ -z "$TELEGRAM_CHAT_ID" ]      && { echo "Missing TAXBAIK_TELEGRAM_CHAT_ID" >&2;      exit 1; }
           [ -z "$TELEGRAM_INQUIRY_CHAT_ID" ] && TELEGRAM_INQUIRY_CHAT_ID="$TELEGRAM_CHAT_ID"
@@ -109,7 +103,11 @@ jobs:
           import json, os, pathlib
           pathlib.Path("./publish/appsettings.Production.json").write_text(
             json.dumps({
+              "ConnectionStrings": {
+                "Default": "Host=localhost;Database=taxbaikdb;Username=taxbaik;Password=taxbaik123"
+              },
               "Jwt":      {"SecretKey": os.environ["JWT_SECRET_KEY"]},
+              "ApiClient": {"BaseUrl": "http://127.0.0.1:5001/api/"},
               "Telegram": {
                 "BotToken": os.environ["TELEGRAM_BOT_TOKEN"],
                 "ChatId": os.environ["TELEGRAM_CHAT_ID"],