diff --git a/.gitea/workflows/ci.yaml b/.gitea/workflows/ci.yaml
index 2aff37f..54eccbe 100644
--- a/.gitea/workflows/ci.yaml
+++ b/.gitea/workflows/ci.yaml
@@ -177,6 +177,7 @@ jobs:
           MCP_API_KEY:          ${{ secrets.MCP_API_KEY }}
         run: |
           ENV_FILE="/opt/memento/.env.docker"
+          rm -f "$ENV_FILE"
           touch "$ENV_FILE"
           upsert() {
             local key="$1" val="$2"
diff --git a/.gitea/workflows/deploy.yaml b/.gitea/workflows/deploy.yaml
index b270f52..e7321d7 100644
--- a/.gitea/workflows/deploy.yaml
+++ b/.gitea/workflows/deploy.yaml
@@ -66,6 +66,7 @@ jobs:
           MCP_API_KEY:          ${{ secrets.MCP_API_KEY }}
         run: |
           ENV_FILE="/opt/memento/.env.docker"
+          rm -f "$ENV_FILE"
           touch "$ENV_FILE"
           upsert() {
             local key="$1" val="$2"
diff --git a/scripts/deploy-prod.sh b/scripts/deploy-prod.sh
index 8f25fd3..f15b20c 100755
--- a/scripts/deploy-prod.sh
+++ b/scripts/deploy-prod.sh
@@ -127,11 +127,9 @@ HEALTH_CHECK_SLEEP_SECONDS=5
 
 cd "$ROOT"
 
-# Sanitize .env.docker: strip CRLF + quotes (Docker Compose v2 rejects VAR="val")
+# Sanitize .env.docker: Docker Compose v2 rejects ANY quote character
 if [ -f "$ROOT/.env.docker" ]; then
-  sed -i 's/\r$//' "$ROOT/.env.docker"
-  sed -i -E 's/^([A-Za-z_][A-Za-z0-9_]*)="(.*)"$/\1=\2/' "$ROOT/.env.docker"
-  sed -i -E "s/^([A-Za-z_][A-Za-z0-9_]*)='(.*)'$/\1=\2/" "$ROOT/.env.docker"
+  tr -d '"' < "$ROOT/.env.docker" > "$ROOT/.env.docker.tmp" && mv "$ROOT/.env.docker.tmp" "$ROOT/.env.docker"
 fi
 
 load_env_docker