diff --git a/.gitea/workflows/deploy-staging.yml b/.gitea/workflows/deploy-staging.yml
index d38cf36..a0f7112 100644
--- a/.gitea/workflows/deploy-staging.yml
+++ b/.gitea/workflows/deploy-staging.yml
@@ -1,15 +1,14 @@
 name: Deploy Staging
 
 # Continuous deployment to the LOCAL staging stack. Fires when develop advances
-# (i.e. after a PR is merged into develop). It re-verifies the code, then rebuilds
-# and restarts the isolated staging stack on this machine.
+# (i.e. after a PR is merged into develop), rebuilding and restarting the isolated
+# staging stack on this machine.
 #
-# CRITICAL: staging lives on your Windows box (ports 18080/18081). A cloud or
-# container runner CANNOT reach it, so this job MUST run on a self-hosted Gitea
-# Actions runner registered ON that Windows machine with Docker access
-# (labels: self-hosted, windows). Until that runner exists this job just waits
-# in the queue (harmless, cancelable) — deploy staging manually meanwhile with:
-#   ./deploy/up.ps1 -Staging
+# Runs on the self-hosted host-mode runner (labels: self-hosted, windows) so it can
+# reach the host's Docker and publish to localhost:18081. Because the runner does a
+# fresh checkout that (correctly) does NOT contain the git-ignored deploy/.env.staging,
+# the staging secrets are supplied as Gitea Actions secrets and the env file is
+# regenerated here at deploy time.
 on:
   push:
     branches: [develop]
@@ -21,12 +20,20 @@ jobs:
     steps:
       - uses: actions/checkout@v4
 
-      # Re-run the gate on the exact merged code before it touches staging.
-      - name: Build + test (Release)
+      - name: Write staging env from secrets
         shell: powershell
+        # Single-quoted here-string: Gitea substitutes the ${{ secrets.* }} tokens
+        # before the shell runs, and PowerShell then treats the values literally
+        # (no $ interpolation). ascii = no BOM, which docker compose's env parser needs.
         run: |
-          dotnet build InboxIntel.sln -c Release --nologo
-          dotnet test  InboxIntel.sln -c Release --no-build --nologo
+          @'
+          POSTGRES_PASSWORD=${{ secrets.STAGING_POSTGRES_PASSWORD }}
+          GOOGLE_CLIENT_ID=${{ secrets.STAGING_GOOGLE_CLIENT_ID }}
+          GOOGLE_CLIENT_SECRET=${{ secrets.STAGING_GOOGLE_CLIENT_SECRET }}
+          AI_MODE=Disabled
+          FRONTEND_ORIGIN=http://localhost:18081
+          MAX_MESSAGES=2000
+          '@ | Out-File -FilePath deploy/.env.staging -Encoding ascii
 
       - name: Redeploy staging stack
         shell: powershell