diff --git a/scripts/deploy.py b/scripts/deploy.py
index f2a0c5b..6e15ea9 100644
--- a/scripts/deploy.py
+++ b/scripts/deploy.py
@@ -57,7 +57,8 @@ LOGIN_EMAIL = os.environ.get("LOGIN_EMAIL", "admin@media-on.de")
 LOGIN_PASSWORD = os.environ.get("LOGIN_PASSWORD", "Admin123!")
 
 # Worker docker-compose definition using ${VARIABLE} syntax.
-# Secrets are read from the .env file on the server (written by write_worker_env).
+# Secrets are managed via Coolify's ENV API (POST/PATCH /services/{uuid}/envs).
+# Coolify auto-generates the .env file from these variables during deploy.
 WORKER_COMPOSE_YAML = """\
 services:
   worker:
@@ -97,8 +98,6 @@ services:
       - coolify.service.subId=500
       - coolify.service.subType=application
       - coolify.service.subName=worker
-    env_file:
-      - .env
 volumes:
   leocrm-worker-storage:
     name: leocrm-worker-storage
@@ -113,16 +112,15 @@ networks:
     external: true
 """
 
-# Worker .env file content (written to server via SSH).
+# Worker ENV variables to set via Coolify API.
 # For different deployments (dev/staging/prod), change these values.
-WORKER_ENV_CONTENT = """\
-SERVICE_NAME_WORKER=worker
-DB_PASSWORD=4B6X2wlfbIx-PyaG8kGutsatdLbjdBUI
-REDIS_PASSWORD=lAjCaTf3XFP5XSaPJ1HElgLAJhQQswLT
-SECRET_KEY=vVdAnvyc-ob4myE5D1rAYn-SovzoBfQLP1z4wmWteTmFPV_lveCGIn2upNoiP590
-ENVIRONMENT=production
-STORAGE_PATH=/data/storage
-"""
+WORKER_ENVS = [
+    {"key": "DB_PASSWORD", "value": "4B6X2wlfbIx-PyaG8kGutsatdLbjdBUI"},
+    {"key": "REDIS_PASSWORD", "value": "lAjCaTf3XFP5XSaPJ1HElgLAJhQQswLT"},
+    {"key": "SECRET_KEY", "value": "vVdAnvyc-ob4myE5D1rAYn-SovzoBfQLP1z4wmWteTmFPV_lveCGIn2upNoiP590"},
+    {"key": "ENVIRONMENT", "value": "production"},
+    {"key": "STORAGE_PATH", "value": "/data/storage"},
+]
 
 
 # ─── Data Structures ──────────────────────────────────────────────────
@@ -328,17 +326,18 @@ def deploy_worker(client: CoolifyClient, skip_build: bool = False) -> StepResult
         if resp.status_code != 200:
             print(f"  Warning: could not set connect_to_docker_network ({resp.status_code})")
 
-        # Step 3: Write .env file to server (AFTER update_service, because
-        # Coolify may regenerate .env during update/deploy)
-        print("  Writing .env file to server...")
-        import base64
-        env_encoded = base64.b64encode(WORKER_ENV_CONTENT.encode()).decode()
-        env_code, env_output = ssh_run(
-            f'echo {env_encoded} | base64 -d > '
-            f'/data/coolify/services/{WORKER_UUID}/.env && echo ENV_OK'
-        )
-        if env_code != 0 or 'ENV_OK' not in env_output:
-            print(f"  Warning: could not write .env ({env_output.strip()})")
+        # Step 3: Set ENV variables via Coolify API (Coolify auto-generates .env)
+        print("  Setting ENV variables via Coolify API...")
+        for env in WORKER_ENVS:
+            # POST creates or updates the ENV variable
+            resp = httpx.post(
+                f"{client.base_url}/api/v1/services/{WORKER_UUID}/envs",
+                headers=client.headers,
+                json=env,
+                timeout=30,
+            )
+            if resp.status_code not in (200, 201):
+                print(f"  Warning: could not set ENV {env['key']} ({resp.status_code})")
 
         # Step 4: Tag the latest API image as :latest
         print("  Tagging latest API image as :latest...")