diff --git a/.gitea/workflows/deploy-dev.yml b/.gitea/workflows/deploy-dev.yml
index efe5aef..4e63df4 100644
--- a/.gitea/workflows/deploy-dev.yml
+++ b/.gitea/workflows/deploy-dev.yml
@@ -1,24 +1,70 @@
-name: Deploy Dev
+name: Deploy Dev — Backend
 
 on:
   push:
     branches:
       - dev
+  workflow_dispatch:
 
 jobs:
   deploy:
+    name: Deploy para VM Dev
     runs-on: self-hosted
+    env:
+      DEPLOY_PATH: /opt/omnichannel
+
     steps:
-      - name: Atualizar código na VM Dev
-        run: |
-          cd /opt/omnichannel/backend
-          git pull origin dev
+      - name: Checkout
+        uses: actions/checkout@v4
 
-      - name: Copiar env
+      - name: Preflight
+        shell: bash
         run: |
-          cp /home/desenvolvimento/.envs/omnichannel/backend.env.development /opt/omnichannel/backend/.env.development
+          set -euo pipefail
+          echo "Runner: $(hostname)"
+          docker --version
+          docker compose version
 
-      - name: Rebuild container
+      - name: Verificar secrets obrigatórios
+        shell: bash
+        env:
+          ENV_DEV: ${{ secrets.ENV_DEV }}
         run: |
-          cd /opt/omnichannel
-          docker compose up -d --build backend
+          set -euo pipefail
+          if [ -z "${ENV_DEV:-}" ]; then
+            echo "Secret ENV_DEV não configurado. Adicione o conteúdo completo do .env.development em Settings > Actions > Secrets."
+            exit 1
+          fi
+
+      - name: Escrever .env.development
+        shell: bash
+        env:
+          ENV_DEV: ${{ secrets.ENV_DEV }}
+        run: |
+          set -euo pipefail
+          printf '%s\n' "$ENV_DEV" > "$DEPLOY_PATH/backend/.env.development"
+          chmod 600 "$DEPLOY_PATH/backend/.env.development"
+
+      - name: Sync código
+        shell: bash
+        run: |
+          set -euo pipefail
+          LOCK="/tmp/omnichannel-backend-dev.lock"
+          (
+            flock -n 9 || { echo "Deploy já em andamento. Tente novamente em instantes."; exit 1; }
+
+            rsync -az --delete \
+              --exclude='.git/' \
+              --exclude='.gitea/' \
+              --exclude='.env*' \
+              --exclude='node_modules/' \
+              ./ "$DEPLOY_PATH/backend/"
+          ) 9>"$LOCK"
+
+      - name: Build e reiniciar container
+        shell: bash
+        run: |
+          set -euo pipefail
+          cd "$DEPLOY_PATH"
+          docker compose build backend
+          docker compose up -d backend
diff --git a/.gitea/workflows/deploy-prod.yml b/.gitea/workflows/deploy-prod.yml
new file mode 100644
index 0000000..6c1cbed
--- /dev/null
+++ b/.gitea/workflows/deploy-prod.yml
@@ -0,0 +1,70 @@
+name: Deploy Prod — Backend
+
+on:
+  push:
+    branches:
+      - master
+  workflow_dispatch:
+
+jobs:
+  deploy:
+    name: Deploy para VM Prod
+    runs-on: self-hosted-prod
+    env:
+      DEPLOY_PATH: /opt/omnichannel
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Preflight
+        shell: bash
+        run: |
+          set -euo pipefail
+          echo "Runner: $(hostname)"
+          docker --version
+          docker compose version
+
+      - name: Verificar secrets obrigatórios
+        shell: bash
+        env:
+          ENV_PROD: ${{ secrets.ENV_PROD }}
+        run: |
+          set -euo pipefail
+          if [ -z "${ENV_PROD:-}" ]; then
+            echo "Secret ENV_PROD não configurado."
+            exit 1
+          fi
+
+      - name: Escrever .env.production
+        shell: bash
+        env:
+          ENV_PROD: ${{ secrets.ENV_PROD }}
+        run: |
+          set -euo pipefail
+          printf '%s\n' "$ENV_PROD" > "$DEPLOY_PATH/backend/.env.production"
+          chmod 600 "$DEPLOY_PATH/backend/.env.production"
+
+      - name: Sync código
+        shell: bash
+        run: |
+          set -euo pipefail
+          LOCK="/tmp/omnichannel-backend-prod.lock"
+          (
+            flock -n 9 || { echo "Deploy já em andamento. Tente novamente em instantes."; exit 1; }
+
+            rsync -az --delete \
+              --exclude='.git/' \
+              --exclude='.gitea/' \
+              --exclude='.env*' \
+              --exclude='node_modules/' \
+              ./ "$DEPLOY_PATH/backend/"
+          ) 9>"$LOCK"
+
+      - name: Build e reiniciar container
+        shell: bash
+        run: |
+          set -euo pipefail
+          cd "$DEPLOY_PATH"
+          docker compose build backend
+          docker compose up -d backend
diff --git a/src/modules/whatsapp/repositories/mensagens.repository.ts b/src/modules/whatsapp/repositories/mensagens.repository.ts
index 31115f5..dfa5de7 100644
--- a/src/modules/whatsapp/repositories/mensagens.repository.ts
+++ b/src/modules/whatsapp/repositories/mensagens.repository.ts
@@ -14,12 +14,14 @@ export class MensagensRepository {
     senderName?: string;
     status?: string;
     timestamp: number;
+    mediaPath?: string;
+    mediaMimeType?: string;
   }) {
     await this.database.query(
-      `INSERT INTO mensagens (wamid, chat_id, from_me, type, body, sender_name, status, timestamp)
-       VALUES ($1, $2, $3, $4, $5, $6, $7, $8)
+      `INSERT INTO mensagens (wamid, chat_id, from_me, type, body, sender_name, status, timestamp, media_path, media_mime_type)
+       VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10)
        ON CONFLICT (wamid) DO NOTHING`,
-      [msg.wamid, msg.chatId, msg.fromMe, msg.type, msg.body ?? null, msg.senderName ?? null, msg.status ?? null, msg.timestamp],
+      [msg.wamid, msg.chatId, msg.fromMe, msg.type, msg.body ?? null, msg.senderName ?? null, msg.status ?? null, msg.timestamp, msg.mediaPath ?? null, msg.mediaMimeType ?? null],
     );
   }