diff --git a/.woodpecker/db.yml b/.woodpecker/db.yml
index 99f7adf..a3336b9 100644
--- a/.woodpecker/db.yml
+++ b/.woodpecker/db.yml
@@ -32,61 +32,20 @@ steps:
     image: alpine:latest
     depends_on: [ secrets ]
     commands:
-      - |
-        set -Eeuo pipefail
-
-        apk add --no-cache bash openssh-client rsync coreutils
-
-        mkdir -p /root/.ssh
-        # проверим, что секретный ключ реально есть
-        [ -s secrets/SSH_KEY ] || { echo "ERROR: secrets/SSH_KEY missing"; ls -laR; exit 1; }
-        install -m 600 secrets/SSH_KEY /root/.ssh/id_rsa
-
-        # sanity: файл с переменными существует и без CRLF
-        [ -f ./ci/prod/.env.runtime ] || { echo "ERROR: ./ci/prod/.env.runtime not found"; exit 1; }
-        sed -i 's/\r$//' ./ci/prod/.env.runtime
-        echo '--- .env.runtime (snippet) ---'
-        grep -nE '^(REMOTE_BASE|DB_DIR|SSH_USER|SSH_HOST)=' ./ci/prod/.env.runtime || true
-
-        # загрузка env-файлов
-        set -a
-        . ./ci/prod/.env.runtime
-        . ./.env.version
-        set +a
-
-        # жёсткие ассерты — если хоть что-то пустое, ОСТАНАВЛИВАЕМСЯ
-        : "${REMOTE_BASE:?missing REMOTE_BASE}"
-        : "${DB_DIR:?missing DB_DIR}"
-        : "${SSH_USER:?missing SSH_USER}"
-        : "${SSH_HOST:?missing SSH_HOST}"
-
-        printf 'REMOTE_BASE=%s\nDB_DIR=%s\nSSH_USER=%s\nSSH_HOST=%s\n' \
-          "$REMOTE_BASE" "$DB_DIR" "$SSH_USER" "$SSH_HOST"
-
-        SSH_OPTS='-i /root/.ssh/id_rsa -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -vv'
-        REMOTE_DIR="${REMOTE_BASE%/}/${DB_DIR}"
-        REMOTE_TARGET="${SSH_USER}@${SSH_HOST}"
-
-        # быстрая проверка, что ключ читается
-        ssh $SSH_OPTS -o BatchMode=yes "$REMOTE_TARGET" 'echo "[whoami] $(whoami) @ $(hostname) $(date -Is)"'
-
-        # синк
-        ssh $SSH_OPTS "$REMOTE_TARGET" "mkdir -p ${REMOTE_DIR}/{compose,env}"
-        rsync -avz --delete -e "ssh $SSH_OPTS" ci/prod/compose/  "$REMOTE_TARGET:${REMOTE_DIR}/compose/"
-        rsync -avz             -e "ssh $SSH_OPTS" ci/prod/.env.runtime "$REMOTE_TARGET:${REMOTE_DIR}/env/.env.runtime"
-
-        # деплой на удалёнке (ВАЖНО: bash -s, чтобы heredoc выполнился)
-        ssh $SSH_OPTS "$REMOTE_TARGET" REMOTE_DIR="$REMOTE_DIR" bash -s <<'EOSSH'
-        set -Eeuxo pipefail
-        echo "[remote] whoami=$(whoami) host=$(hostname) pwd=$PWD"
-        cd "${REMOTE_DIR}/compose"
-        set -a; . ../env/.env.runtime; set +a
-        docker compose -f db.yml pull
-        docker compose -f db.yml up -d --remove-orphans
-        docker compose ps
-        date -Is | tee .last_deploy
-        logger -t deploy-db "db deployed at $(date -Is) in ${REMOTE_DIR}"
-        EOSSH
+      - set -Eeuxo pipefail
+      - apk add --no-cache bash openssh-client rsync coreutils
+      - mkdir -p /root/.ssh
+      - install -m 600 secrets/SSH_KEY /root/.ssh/id_rsa
+      # страхуемся от CRLF в env-файле
+      - sed -i 's/\r$//' ./ci/prod/.env.runtime
+      # поднимаем переменные для скрипта
+      - set -a
+      - . ./ci/prod/.env.runtime
+      - . ./.env.version
+      - set +a
+      # просто запускаем внешний скрипт
+      - bash ci/prod/scripts/deploy-db.sh
+
 
 
 
diff --git a/ci/prod/scripts/deploy-db.sh b/ci/prod/scripts/deploy-db.sh
index 6c9ae70..534723b 100755
--- a/ci/prod/scripts/deploy-db.sh
+++ b/ci/prod/scripts/deploy-db.sh
@@ -1,28 +1,36 @@
 #!/usr/bin/env bash
-set -Eeuxo pipefail
+set -Eeuo pipefail
 trap 'echo "[deploy-db] failed at line $LINENO"; exit 1' ERR
 
+# Требуем ключевые переменные уже ПРОБРОШЕННЫЕ из шага CI
 : "${REMOTE_BASE:?missing REMOTE_BASE}"
 : "${DB_DIR:?missing DB_DIR}"
 : "${SSH_USER:?missing SSH_USER}"
 : "${SSH_HOST:?missing SSH_HOST}"
 
-SSH_OPTS='-i /root/.ssh/id_rsa -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -vv'
 REMOTE_DIR="${REMOTE_BASE%/}/${DB_DIR}"
 REMOTE_TARGET="${SSH_USER}@${SSH_HOST}"
+SSH_OPTS=(-i /root/.ssh/id_rsa -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -o BatchMode=yes -vv)
 
-ssh $SSH_OPTS "$REMOTE_TARGET" 'echo "[whoami] $(whoami) @ $(hostname) $(date -Is)"'
+echo "[local] REMOTE_DIR=${REMOTE_DIR} REMOTE_TARGET=${REMOTE_TARGET}"
 
-ssh $SSH_OPTS "$REMOTE_TARGET" "mkdir -p ${REMOTE_DIR}/{compose,env}"
-rsync -avz --delete -e "ssh $SSH_OPTS" ci/prod/compose/  "$REMOTE_TARGET:${REMOTE_DIR}/compose/"
-rsync -avz             -e "ssh $SSH_OPTS" ci/prod/.env.runtime "$REMOTE_TARGET:${REMOTE_DIR}/env/.env.runtime"
+# Кто мы на удалёнке (оставляет след в логе CI)
+ssh "${SSH_OPTS[@]}" "$REMOTE_TARGET" 'echo "[whoami] $(whoami) @ $(hostname) $(date -Is)"'
 
+# Создание директорий и синк
+ssh "${SSH_OPTS[@]}" "$REMOTE_TARGET" "mkdir -p ${REMOTE_DIR}/{compose,env}"
+rsync -avz --delete -e "ssh ${SSH_OPTS[*]}" ci/prod/compose/      "$REMOTE_TARGET:${REMOTE_DIR}/compose/"
+rsync -avz             -e "ssh ${SSH_OPTS[*]}" ci/prod/.env.runtime "$REMOTE_TARGET:${REMOTE_DIR}/env/.env.runtime"
+
+# Контрольная сумма — доказательство доставки
 local_sum="$(sha256sum ci/prod/compose/db.yml | awk '{print $1}')"
-remote_sum="$(ssh $SSH_OPTS "$REMOTE_TARGET" "sha256sum ${REMOTE_DIR}/compose/db.yml | awk '{print \$1}'")"
+remote_sum="$(ssh "${SSH_OPTS[@]}" "$REMOTE_TARGET" "sha256sum ${REMOTE_DIR}/compose/db.yml | awk '{print \$1}'")"
 echo "[sha256] local=$local_sum remote=$remote_sum"
 
-ssh $SSH_OPTS "$REMOTE_TARGET" REMOTE_DIR="$REMOTE_DIR" <<'EOSSH'
+# Деплой на удалёнке (ВАЖНО: 'bash -s', чтобы heredoc выполнился)
+ssh "${SSH_OPTS[@]}" "$REMOTE_TARGET" REMOTE_DIR="$REMOTE_DIR" bash -s <<'EOSSH'
 set -Eeuxo pipefail
+echo "[remote] whoami=$(whoami) host=$(hostname) pwd=$PWD"
 cd "${REMOTE_DIR}/compose"
 set -a
 . ../env/.env.runtime