diff --git a/.gitea/workflows/build-and-deploy.yml b/.gitea/workflows/build-and-deploy.yml
index 5063fb5..a6b92ea 100644
--- a/.gitea/workflows/build-and-deploy.yml
+++ b/.gitea/workflows/build-and-deploy.yml
@@ -135,8 +135,8 @@ jobs:
 
       - name: Check SSH tools
         run: |
-          if ! command -v ssh >/dev/null 2>&1 || ! command -v tar >/dev/null 2>&1; then
-            echo "::error::ssh and tar must be available in the runner image; this workflow cannot install packages while runner DNS is unavailable."
+          if ! command -v ssh >/dev/null 2>&1 || ! command -v ssh-keygen >/dev/null 2>&1 || ! command -v tar >/dev/null 2>&1; then
+            echo "::error::ssh, ssh-keygen, and tar must be available in the runner image; this workflow cannot install packages while runner DNS is unavailable."
             exit 1
           fi
 
@@ -147,8 +147,12 @@ jobs:
           VPS_HOST="${VPS_HOST:-$DEPLOY_SSH_HOST}"
           echo "Using SSH host $VPS_HOST"
           mkdir -p ~/.ssh && chmod 700 ~/.ssh
-          echo "${{ secrets.VPS_SSH_KEY }}" > ~/.ssh/id_rsa
+          printf '%b\n' '${{ secrets.VPS_SSH_KEY }}' | tr -d '\r' > ~/.ssh/id_rsa
           chmod 600 ~/.ssh/id_rsa
+          if ! ssh-keygen -y -f ~/.ssh/id_rsa >/dev/null 2>&1; then
+            echo "::error::VPS_SSH_KEY is not a readable private key. Store the full private key with real newlines, including BEGIN and END lines."
+            exit 1
+          fi
           touch ~/.ssh/known_hosts
           ssh-keyscan -H "$VPS_HOST" >> ~/.ssh/known_hosts 2>/dev/null || true
           chmod 644 ~/.ssh/known_hosts
@@ -289,8 +293,8 @@ jobs:
       - name: Install SSH client
         if: steps.check-creds.outputs.skip == 'false'
         run: |
-          if ! command -v ssh >/dev/null 2>&1 || ! command -v scp >/dev/null 2>&1; then
-            echo "::error::ssh and scp must be available in the runner image; this workflow cannot install openssh-client while runner DNS is unavailable."
+          if ! command -v ssh >/dev/null 2>&1 || ! command -v ssh-keygen >/dev/null 2>&1 || ! command -v scp >/dev/null 2>&1; then
+            echo "::error::ssh, ssh-keygen, and scp must be available in the runner image; this workflow cannot install openssh-client while runner DNS is unavailable."
             exit 1
           fi
 
@@ -302,8 +306,12 @@ jobs:
           VPS_HOST="${VPS_HOST:-$DEPLOY_SSH_HOST}"
           echo "Using SSH host $VPS_HOST"
           mkdir -p ~/.ssh && chmod 700 ~/.ssh
-          echo "${{ secrets.VPS_SSH_KEY }}" > ~/.ssh/id_rsa
+          printf '%b\n' '${{ secrets.VPS_SSH_KEY }}' | tr -d '\r' > ~/.ssh/id_rsa
           chmod 600 ~/.ssh/id_rsa
+          if ! ssh-keygen -y -f ~/.ssh/id_rsa >/dev/null 2>&1; then
+            echo "::error::VPS_SSH_KEY is not a readable private key. Store the full private key with real newlines, including BEGIN and END lines."
+            exit 1
+          fi
           touch ~/.ssh/known_hosts
           ssh-keyscan -H "$VPS_HOST" >> ~/.ssh/known_hosts 2>/dev/null || true
           chmod 644 ~/.ssh/known_hosts