diff --git a/.woodpecker.yml b/.woodpecker.yml
index 10e1128..772edfa 100644
--- a/.woodpecker.yml
+++ b/.woodpecker.yml
@@ -22,21 +22,19 @@ steps:
 
         echo "🔑 SSH prerequisites installed"
 
-        # ── Fetch canonical IMG_TAG ──────────────────────────────────────
-        IMG_TAG=$(gcloud secrets versions access latest \
-          --secret=IMG_TAG --project=aptivaai-dev)
-        echo "📦 IMG_TAG=${IMG_TAG}"
-
         # ── SSH into staging and deploy ──────────────────────────────────
         ssh -o StrictHostKeyChecking=yes \
             -i ~/.ssh/id_ed25519 \
             jcoakley@10.128.0.12 \
-            "export IMG_TAG=${IMG_TAG}; \
+            'set -euo pipefail; \
+             IMG_TAG=$(gcloud secrets versions access latest --secret=IMG_TAG --project=aptivaai-dev); \
+             export IMG_TAG; \
+             echo "📦 IMG_TAG=$IMG_TAG"; \
              cd /home/jcoakley/aptiva-staging-app; \
-             echo 'IMG_TAG = ${IMG_TAG}'; \
+             echo "IMG_TAG = $IMG_TAG"; \
              sudo --preserve-env=IMG_TAG docker compose pull; \
              sudo --preserve-env=IMG_TAG docker compose up -d --force-recreate --remove-orphans; \
-             echo '✅ Staging stack refreshed with tag ${IMG_TAG}'"
+             echo "✅ Staging stack refreshed with tag $IMG_TAG"'
 
     secrets:
       - STAGING_SSH_KEY