diff --git a/compose/stack.yaml b/compose/stack.yaml
index 33adc6e..eb77cfc 100644
--- a/compose/stack.yaml
+++ b/compose/stack.yaml
@@ -47,9 +47,9 @@ services:
       - /opt/nextworkspace/:/opt/nextworkspace/
     working_dir: /opt/nextworkspace
     command: /opt/nextworkspace/nextworkspace
-    env_file: /opt/nextworkspace/.env
     environment:
       - CONFIG_DIR=/opt/nextworkspace/config/nextworkspace
+      - AUTHELIA_SECRET={AUTHELIA_SECRET}
     healthcheck:
       test: ["CMD", "wget", "-qO-", "http://127.0.0.1:9000/health"]
       interval: 30s
diff --git a/deploy.sh b/deploy.sh
index 8c7d305..e89bd81 100755
--- a/deploy.sh
+++ b/deploy.sh
@@ -89,25 +89,28 @@ if [ "$GREENFIELD" = true ]; then
     sed -e "s|{ADMIN_PASSWORD_HASH}|$ADMIN_PASSWORD_HASH|g" -e "s|{TLS_EMAIL}|${TLS_EMAIL:-admin@$DOMAIN}|g" \
         "$SCRIPT_DIR/config/authelia/users_database.yml" > "$TARGET_DIR/config/authelia/users_database.yml"
 
-    # Copy files
-    cp "$SCRIPT_DIR/compose/stack.yaml" "$TARGET_DIR/compose/stack.yaml"
     cp nextworkspace "$TARGET_DIR/nextworkspace"
     if [ -f "$REPO_DIR/VERSION" ]; then cp "$REPO_DIR/VERSION" "$TARGET_DIR/VERSION"; fi
     if [ -d "$SCRIPT_DIR/config/www" ]; then cp -r "$SCRIPT_DIR/config/www"/* "$TARGET_DIR/www/"; fi
     cp -r "$SCRIPT_DIR/config/nextworkspace"/* "$TARGET_DIR/config/nextworkspace/" 2>/dev/null || true
 
-    # Podman network + deploy stack
+    # Create podman network and deploy Caddy + Authelia
     echo "[5/5] Deploying containers on $NETWORK_NAME..."
     podman network create "$NETWORK_NAME" 2>&1 || true
-    podman-compose -f "$TARGET_DIR/compose/stack.yaml" down 2>/dev/null || true
-    podman-compose -f "$TARGET_DIR/compose/stack.yaml" up -d 2>&1 || echo "[WARN] Stack deploy had issues"
-
     sleep 3
+
+    # Extract AUTHELIA_SECRET from config
     AUTHELIA_SECRET=$(grep -oP 'session_secret: \K.*' "$TARGET_DIR/config/authelia/configuration.yml" 2>/dev/null || echo "")
     if [ -n "$AUTHELIA_SECRET" ] && ! grep -q "AUTHELIA_SECRET" "$BACKUP_DIR/.env" 2>/dev/null; then
         echo "AUTHELIA_SECRET=$AUTHELIA_SECRET" >> "$BACKUP_DIR/.env"
     fi
 
+    # Generate compose file with secret, then deploy
+    sed -e "s|{AUTHELIA_SECRET}|$AUTHELIA_SECRET|g" \
+        "$SCRIPT_DIR/compose/stack.yaml" > "$TARGET_DIR/compose/stack.yaml"
+    podman-compose -f "$TARGET_DIR/compose/stack.yaml" down 2>/dev/null || true
+    podman-compose -f "$TARGET_DIR/compose/stack.yaml" up -d 2>&1 || echo "[WARN] Stack deploy had issues"
+
 # --- Smart update ---
 else
     echo "[3/5] Redeploying containers..."