diff --git a/.gitea/workflows/ci-deploy.yml b/.gitea/workflows/ci-deploy.yml
index ba4d4d0..bed545a 100644
--- a/.gitea/workflows/ci-deploy.yml
+++ b/.gitea/workflows/ci-deploy.yml
@@ -331,6 +331,12 @@ jobs:
               echo "MAINTENANCE_GITEA_TOKEN is not configured as a repository Actions secret."
               exit 1
             fi
+            case "$MAINTENANCE_GITEA_TOKEN" in
+              *[!A-Za-z0-9_-]*)
+                echo "MAINTENANCE_GITEA_TOKEN must be a single token value, not a pasted dotenv block."
+                exit 1
+                ;;
+            esac
             shared_env=/opt/job-tracker/shared/.env
             if [ ! -f "$shared_env" ]; then
               echo "Expected deployment environment at $shared_env."
@@ -338,9 +344,13 @@ jobs:
             fi
             env_tmp="$(mktemp)"
             trap 'rm -f "$env_tmp"' EXIT
-            grep -v '^MAINTENANCE_GITEA_TOKEN=' "$shared_env" > "$env_tmp"
+            grep -Ev '^MAINTENANCE_GITEA_TOKEN=|^```(dotenv)?[[:space:]]*$' "$shared_env" > "$env_tmp"
             printf 'MAINTENANCE_GITEA_TOKEN=%s\n' "$MAINTENANCE_GITEA_TOKEN" >> "$env_tmp"
             chmod --reference="$shared_env" "$env_tmp"
+            if ! docker compose --env-file "$env_tmp" -f docker-compose.yml config --quiet; then
+              echo "Refusing to replace the shared deployment environment because it is invalid."
+              exit 1
+            fi
             cat "$env_tmp" > "$shared_env"
             rm -f "$env_tmp"
             trap - EXIT
diff --git a/deploy/deploy.sh b/deploy/deploy.sh
index e826786..906c4d1 100644
--- a/deploy/deploy.sh
+++ b/deploy/deploy.sh
@@ -406,7 +406,10 @@ verify_backup_file_shape() {
 
 report_backup() {
   local target="$1" size
-  chmod 600 "$target"
+  if ! chmod 600 "$target" 2>/dev/null; then
+    docker run --rm -v "$BACKUP_DIR":/backup -e BACKUP_FILE="$(basename "$target")" \
+      alpine:3 sh -c 'chmod 600 "/backup/$BACKUP_FILE"'
+  fi
   size="$(du -h "$target" | cut -f1)"
   echo "Backup verified: ${target} (${size})"
   return 0