diff --git a/.gitea/workflows/ci.yaml b/.gitea/workflows/ci.yaml
index e42537f..2aff37f 100644
--- a/.gitea/workflows/ci.yaml
+++ b/.gitea/workflows/ci.yaml
@@ -182,7 +182,7 @@ jobs:
             local key="$1" val="$2"
             [ -z "$val" ] && return
             sed -i "/^[[:space:]]*${key}=/d" "$ENV_FILE"
-            echo "${key}=\"${val}\"" >> "$ENV_FILE"
+            echo "${key}=${val}" >> "$ENV_FILE"
           }
           upsert NEXTAUTH_URL           "$APP_URL"
           upsert NEXTAUTH_SECRET        "$NEXTAUTH_SECRET"
diff --git a/scripts/deploy-prod.sh b/scripts/deploy-prod.sh
index fc1b0f4..8f25fd3 100755
--- a/scripts/deploy-prod.sh
+++ b/scripts/deploy-prod.sh
@@ -127,10 +127,11 @@ HEALTH_CHECK_SLEEP_SECONDS=5
 
 cd "$ROOT"
 
-# Sanitize .env.docker: Docker Compose v2 rejects quoted values (VAR="val" → VAR=val)
+# Sanitize .env.docker: strip CRLF + quotes (Docker Compose v2 rejects VAR="val")
 if [ -f "$ROOT/.env.docker" ]; then
-  sed -i -E 's/^([A-Za-z_][A-Za-z0-9_]*)="(.*)"$/\1=\2/' "$ROOT/.env.docker" || true
-  sed -i -E "s/^([A-Za-z_][A-Za-z0-9_]*)='(.*)'$/\1=\2/" "$ROOT/.env.docker" || true
+  sed -i 's/\r$//' "$ROOT/.env.docker"
+  sed -i -E 's/^([A-Za-z_][A-Za-z0-9_]*)="(.*)"$/\1=\2/' "$ROOT/.env.docker"
+  sed -i -E "s/^([A-Za-z_][A-Za-z0-9_]*)='(.*)'$/\1=\2/" "$ROOT/.env.docker"
 fi
 
 load_env_docker