diff --git a/.gitea/workflows/ci.yaml b/.gitea/workflows/ci.yaml
index d0955fa..1c9ff6e 100644
--- a/.gitea/workflows/ci.yaml
+++ b/.gitea/workflows/ci.yaml
@@ -7,20 +7,24 @@ on:
   pull_request:
 
 jobs:
-  build:
-    name: Build
+  build-deploy:
+    name: Build and Deploy
     runs-on: ubuntu
 
     env:
       NEXT_TELEMETRY_DISABLED: 1
-      DATABASE_URL: ${{ secrets.DATABASE_URL }}
-      NEXTAUTH_URL: ${{ secrets.NEXTAUTH_URL }}
-      NEXTAUTH_SECRET: ${{ secrets.NEXTAUTH_SECRET }}
+      NODE_ENV: production
 
     steps:
       - name: Checkout
         uses: actions/checkout@v4
 
+      - name: Load local runtime env
+        run: |
+          set -a
+          . /opt/RFP_Finanzen/.env
+          set +a
+
       - name: Show environment
         run: |
           whoami
@@ -28,7 +32,7 @@ jobs:
           pwd
           node -v
           npm -v
-  
+
       - name: Clean old build artifacts
         run: rm -rf .next
 
@@ -41,73 +45,41 @@ jobs:
       - name: Build app
         run: npm run build
 
-  deploy:
-    name: Deploy
-    if: gitea.event_name == 'push'
-    needs: build
-    runs-on: ubuntu
-
-    env:
-      NEXT_TELEMETRY_DISABLED: 1
-      DATABASE_URL: ${{ secrets.DATABASE_URL }}
-      NEXTAUTH_URL: ${{ secrets.NEXTAUTH_URL }}
-      NEXTAUTH_SECRET: ${{ secrets.NEXTAUTH_SECRET }}
-
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v4
-
-      - name: Sync project to target directory
+      - name: Deploy to target directory
+        if: gitea.event_name == 'push'
         run: |
           rsync -av --delete \
             --exclude ".git" \
             --exclude ".github" \
-            --exclude "node_modules" \
-            --exclude ".next" \
             --exclude ".env" \
+            --exclude "node_modules" \
             ./ /opt/RFP_Finanzen/
 
-      - name: Write runtime .env
-        run: |
-          cat > /opt/RFP_Finanzen/.env <<EOF
-          DATABASE_URL=${{ secrets.DATABASE_URL }}
-          NEXTAUTH_URL=${{ secrets.NEXTAUTH_URL }}
-          NEXTAUTH_SECRET=${{ secrets.NEXTAUTH_SECRET }}
-          NODE_ENV=production
-          EOF
-          chmod 600 /opt/RFP_Finanzen/.env
-
-      - name: Install dependencies on target
+      - name: Install production dependencies on target
+        if: gitea.event_name == 'push'
         run: |
           cd /opt/RFP_Finanzen
           npm install
 
-      - name: Prisma generate on target
-        run: |
-          cd /opt/RFP_Finanzen
-          npx prisma generate
-
-      - name: Build app on target
-        run: |
-          cd /opt/RFP_Finanzen
-          rm -rf .next
-          npm run build
-
       - name: Run Prisma migrations on target
+        if: gitea.event_name == 'push'
         run: |
           cd /opt/RFP_Finanzen
+          set -a
+          . ./.env
+          set +a
           npx prisma migrate deploy
 
       - name: Restart service
+        if: gitea.event_name == 'push'
         run: sudo systemctl restart finanzen-app
 
       - name: Show service status
-        run: sudo systemctl --no-pager --full status finanzen-app
-
-      - name: Show service status
+        if: gitea.event_name == 'push'
         run: sudo systemctl --no-pager --full status finanzen-app
 
       - name: Test local app endpoint
+        if: gitea.event_name == 'push'
         run: |
           sleep 3
           curl -I http://127.0.0.1:3000
\ No newline at end of file