diff --git a/.gitea/workflows/deploy-production.yml b/.gitea/workflows/deploy-production.yml
index 6822d2a..f37529f 100644
--- a/.gitea/workflows/deploy-production.yml
+++ b/.gitea/workflows/deploy-production.yml
@@ -27,15 +27,29 @@ jobs:
           pm2 --version
           rsync --version | head -n 1
 
+      - name: Check required secrets
+        shell: bash
+        run: |
+          set -euo pipefail
+          if [ -z "${{ secrets.ENV_PRODUCTION }}" ]; then
+            echo "Missing secret ENV_PRODUCTION. Configure it in Settings > Actions > Secrets before deploying."
+            exit 1
+          fi
+
       - name: Validate JavaScript
         shell: bash
         run: |
           set -euo pipefail
-          node --check cron.js
-          node --check src/app.js
-          node --check src/controllers/processTicketLifecycleController.js
-          node --check src/services/servicenowService.js
-          node --check src/services/glpiTicketService.js
+          find . -path ./node_modules -prune -o -name '*.js' -print | xargs -n1 node --check
+
+      - name: Write .env.production from secret
+        shell: bash
+        run: |
+          set -euo pipefail
+          DEPLOY_PATH="${PROD_DEPLOY_PATH:-/opt/sn-glpi-sync-new}"
+          mkdir -p "$DEPLOY_PATH"
+          printf '%s\n' "${{ secrets.ENV_PRODUCTION }}" > "$DEPLOY_PATH/.env.production"
+          chmod 600 "$DEPLOY_PATH/.env.production"
 
       - name: Deploy files and restart PM2
         shell: bash
@@ -53,6 +67,10 @@ jobs:
               exit 1
             }
 
+            if [ -d "$DEPLOY_PATH" ] && [ -n "$(ls -A "$DEPLOY_PATH" 2>/dev/null)" ]; then
+              rsync -a --delete "$DEPLOY_PATH"/ "$DEPLOY_PATH.previous"/
+            fi
+
             rsync -az --delete \
               --exclude='.git/' \
               --exclude='.gitea/' \
@@ -75,11 +93,7 @@ jobs:
 
             npm ci --omit=dev
 
-            node --check cron.js
-            node --check src/app.js
-            node --check src/controllers/processTicketLifecycleController.js
-            node --check src/services/servicenowService.js
-            node --check src/services/glpiTicketService.js
+            find . -path ./node_modules -prune -o -name '*.js' -print | xargs -n1 node --check
 
             pm2 startOrRestart ecosystem.config.js --env production
             pm2 save