diff --git a/.gitea/workflows/build-and-deploy.yml b/.gitea/workflows/build-and-deploy.yml
index a6b92ea..e9eb25f 100644
--- a/.gitea/workflows/build-and-deploy.yml
+++ b/.gitea/workflows/build-and-deploy.yml
@@ -124,12 +124,17 @@ jobs:
         id: check-build-host
         env:
           VPS_HOST: ${{ secrets.VPS_IP }}
+          VPS_SSH_KEY: ${{ secrets.VPS_SSH_KEY }}
+          VPS_SSH_KEY_B64: ${{ secrets.VPS_SSH_KEY_B64 }}
         run: |
           VPS_HOST="${VPS_HOST:-$DEPLOY_SSH_HOST}"
-          if [ -z "${{ secrets.VPS_SSH_KEY }}" ] || \
-             [ -z "$VPS_HOST" ] || \
+          if [ -z "$VPS_SSH_KEY" ] && [ -z "$VPS_SSH_KEY_B64" ]; then
+            echo "::error::VPS_SSH_KEY_B64 or VPS_SSH_KEY is required to build on the remote Docker host"
+            exit 1
+          fi
+          if [ -z "$VPS_HOST" ] || \
              [ -z "${{ secrets.VPS_USER }}" ]; then
-            echo "::error::VPS_SSH_KEY, VPS_USER, and either VPS_IP or DEPLOY_SSH_HOST are required to build on the remote Docker host"
+            echo "::error::VPS_USER and either VPS_IP or DEPLOY_SSH_HOST are required to build on the remote Docker host"
             exit 1
           fi
 
@@ -143,14 +148,20 @@ jobs:
       - name: Set up SSH key
         env:
           VPS_HOST: ${{ secrets.VPS_IP }}
+          VPS_SSH_KEY: ${{ secrets.VPS_SSH_KEY }}
+          VPS_SSH_KEY_B64: ${{ secrets.VPS_SSH_KEY_B64 }}
         run: |
           VPS_HOST="${VPS_HOST:-$DEPLOY_SSH_HOST}"
           echo "Using SSH host $VPS_HOST"
           mkdir -p ~/.ssh && chmod 700 ~/.ssh
-          printf '%b\n' '${{ secrets.VPS_SSH_KEY }}' | tr -d '\r' > ~/.ssh/id_rsa
+          if [ -n "$VPS_SSH_KEY_B64" ]; then
+            printf '%s' "$VPS_SSH_KEY_B64" | base64 -d > ~/.ssh/id_rsa
+          else
+            printf '%b\n' "$VPS_SSH_KEY" | tr -d '\r' > ~/.ssh/id_rsa
+          fi
           chmod 600 ~/.ssh/id_rsa
           if ! ssh-keygen -y -f ~/.ssh/id_rsa >/dev/null 2>&1; then
-            echo "::error::VPS_SSH_KEY is not a readable private key. Store the full private key with real newlines, including BEGIN and END lines."
+            echo "::error::SSH private key is not readable. Prefer setting VPS_SSH_KEY_B64 to: base64 -w0 /path/to/private_key"
             exit 1
           fi
           touch ~/.ssh/known_hosts
@@ -279,9 +290,11 @@ jobs:
         id: check-creds
         env:
           VPS_HOST: ${{ secrets.VPS_IP }}
+          VPS_SSH_KEY: ${{ secrets.VPS_SSH_KEY }}
+          VPS_SSH_KEY_B64: ${{ secrets.VPS_SSH_KEY_B64 }}
         run: |
           VPS_HOST="${VPS_HOST:-$DEPLOY_SSH_HOST}"
-          if [ -z "${{ secrets.VPS_SSH_KEY }}" ] || \
+          if { [ -z "$VPS_SSH_KEY" ] && [ -z "$VPS_SSH_KEY_B64" ]; } || \
              [ -z "$VPS_HOST" ] || \
              [ -z "${{ secrets.VPS_USER }}" ]; then
             echo "VPS secrets not fully configured — skipping deploy"
@@ -302,14 +315,20 @@ jobs:
         if: steps.check-creds.outputs.skip == 'false'
         env:
           VPS_HOST: ${{ secrets.VPS_IP }}
+          VPS_SSH_KEY: ${{ secrets.VPS_SSH_KEY }}
+          VPS_SSH_KEY_B64: ${{ secrets.VPS_SSH_KEY_B64 }}
         run: |
           VPS_HOST="${VPS_HOST:-$DEPLOY_SSH_HOST}"
           echo "Using SSH host $VPS_HOST"
           mkdir -p ~/.ssh && chmod 700 ~/.ssh
-          printf '%b\n' '${{ secrets.VPS_SSH_KEY }}' | tr -d '\r' > ~/.ssh/id_rsa
+          if [ -n "$VPS_SSH_KEY_B64" ]; then
+            printf '%s' "$VPS_SSH_KEY_B64" | base64 -d > ~/.ssh/id_rsa
+          else
+            printf '%b\n' "$VPS_SSH_KEY" | tr -d '\r' > ~/.ssh/id_rsa
+          fi
           chmod 600 ~/.ssh/id_rsa
           if ! ssh-keygen -y -f ~/.ssh/id_rsa >/dev/null 2>&1; then
-            echo "::error::VPS_SSH_KEY is not a readable private key. Store the full private key with real newlines, including BEGIN and END lines."
+            echo "::error::SSH private key is not readable. Prefer setting VPS_SSH_KEY_B64 to: base64 -w0 /path/to/private_key"
             exit 1
           fi
           touch ~/.ssh/known_hosts