diff --git a/ci/prod/compose/db.yml b/ci/prod/compose/db.yml
index 214d3f8..fc6f574 100644
--- a/ci/prod/compose/db.yml
+++ b/ci/prod/compose/db.yml
@@ -126,7 +126,7 @@ services:
         until mongosh --quiet --host sendico_db1 --port ${MONGO_PORT} --eval "db.adminCommand({ ping: 1 })"; do
           echo "waiting for MongoDB…"; sleep 2;
         done
-        mongosh --host sendico_db1 --port ${MONGO_PORT} -u "$u" -p "$p" --authenticationDatabase admin <<EOJS
+        mongosh --host sendico_db1 --port ${MONGO_PORT} -u "$$u" -p "$$p" --authenticationDatabase admin <<'EOJS'
           try { rs.status() } catch (e) {
             rs.initiate({
               _id: "${MONGO_REPLICA_SET}",
@@ -154,9 +154,9 @@ services:
     command: |
       sh -lc '
         . /etc/backup/pbm.env
-        U=$(cat /etc/backup/.u) ; P=$(cat /etc/backup/.p)
+        U=$$(cat /etc/backup/.u) ; P=$$(cat /etc/backup/.p)
         export AWS_EC2_METADATA_DISABLED=true
-        export PBM_MONGODB_URI="mongodb://${U}:${P}@sendico_db1:${MONGO_PORT}/?authSource=${MONGO_AUTH_SOURCE}&replicaSet=${MONGO_REPLICA_SET}"
+        export PBM_MONGODB_URI="mongodb://$${U}:$${P}@sendico_db1:${MONGO_PORT}/?authSource=${MONGO_AUTH_SOURCE}&replicaSet=${MONGO_REPLICA_SET}"
         exec pbm-agent --config=/etc/backup/pbm-config.yaml
       '
 
@@ -173,9 +173,9 @@ services:
     command: |
       sh -lc '
         . /etc/backup/pbm.env
-        U=$(cat /etc/backup/.u) ; P=$(cat /etc/backup/.p)
+        U=$$(cat /etc/backup/.u) ; P=$$(cat /etc/backup/.p)
         export AWS_EC2_METADATA_DISABLED=true
-        export PBM_MONGODB_URI="mongodb://${U}:${P}@sendico_db2:${MONGO_PORT}/?authSource=${MONGO_AUTH_SOURCE}&replicaSet=${MONGO_REPLICA_SET}"
+        export PBM_MONGODB_URI="mongodb://$${U}:$${P}@sendico_db2:${MONGO_PORT}/?authSource=${MONGO_AUTH_SOURCE}&replicaSet=${MONGO_REPLICA_SET}"
         exec pbm-agent --config=/etc/backup/pbm-config.yaml
       '
 
@@ -192,8 +192,8 @@ services:
     command: |
       sh -lc '
         . /etc/backup/pbm.env
-        U=$(cat /etc/backup/.u) ; P=$(cat /etc/backup/.p)
+        U=$$(cat /etc/backup/.u) ; P=$$(cat /etc/backup/.p)
         export AWS_EC2_METADATA_DISABLED=true
-        export PBM_MONGODB_URI="mongodb://${U}:${P}@sendico_db3:${MONGO_PORT}/?authSource=${MONGO_AUTH_SOURCE}&replicaSet=${MONGO_REPLICA_SET}"
+        export PBM_MONGODB_URI="mongodb://$${U}:$${P}@sendico_db3:${MONGO_PORT}/?authSource=${MONGO_AUTH_SOURCE}&replicaSet=${MONGO_REPLICA_SET}"
         exec pbm-agent --config=/etc/backup/pbm-config.yaml
       '
diff --git a/ci/prod/scripts/deploy-db.sh b/ci/prod/scripts/deploy-db.sh
index 30a9e62..b4f0be7 100755
--- a/ci/prod/scripts/deploy-db.sh
+++ b/ci/prod/scripts/deploy-db.sh
@@ -12,6 +12,8 @@ ssh -o StrictHostKeyChecking=no "$REMOTE_TARGET" "mkdir -p ${REMOTE_DIR}/{compos
 rsync -avz --delete ci/prod/compose/ "$REMOTE_TARGET:${REMOTE_DIR}/compose/"
 rsync -avz ci/prod/.env.runtime "$REMOTE_TARGET:${REMOTE_DIR}/env/.env.runtime"
 rsync -avz ci/prod/env/.env.lock.db "$REMOTE_TARGET:${REMOTE_DIR}/env/.env.lock.db"
+rsync -avz secrets/REGISTRY_USER "$REMOTE_TARGET:${REMOTE_DIR}/env/.env.registry.user"
+rsync -avz secrets/REGISTRY_PASS "$REMOTE_TARGET:${REMOTE_DIR}/env/.env.registry.pass"
 scp -o StrictHostKeyChecking=no .env.lock "$REMOTE_TARGET:${REMOTE_DIR}/.env.lock"
 ssh -o StrictHostKeyChecking=no "$REMOTE_TARGET" REMOTE_DIR="$REMOTE_DIR" <<'EOSSH'
   set -euo pipefail
@@ -19,6 +21,9 @@ ssh -o StrictHostKeyChecking=no "$REMOTE_TARGET" REMOTE_DIR="$REMOTE_DIR" <<'EOS
   set -a
   . ../env/.env.runtime
   . ../env/.env.lock.db
+  export REGISTRY_USER="$(cat ../env/.env.registry.user)"
+  export REGISTRY_PASS="$(cat ../env/.env.registry.pass)"
+  echo "${REGISTRY_PASS}" | docker login "${REGISTRY_URL}" --username "${REGISTRY_USER}" --password-stdin >/dev/null
   set +a
   docker compose -f db.yml pull
   docker compose -f db.yml up -d --remove-orphans