diff --git a/.gitea/workflows/build-and-deploy.yml b/.gitea/workflows/build-and-deploy.yml
index 9dcab48..b61ce7b 100644
--- a/.gitea/workflows/build-and-deploy.yml
+++ b/.gitea/workflows/build-and-deploy.yml
@@ -421,76 +421,3 @@ jobs:
               docker push '$IMAGE_LATEST'
             fi
           "
-
-      - name: Deploy production stack on VPS
-        env:
-          IMAGE_REPOSITORY: ${{ steps.image-meta.outputs.repository }}
-          IMAGE_TAG: ${{ gitea.sha }}
-          ENV_DOCKER_PRODUCTION: ${{ secrets.ENV_DOCKER_PRODUCTION }}
-          ENV_DOCKER_PRODUCTION_B64: ${{ secrets.ENV_DOCKER_PRODUCTION_B64 }}
-          STRIPE_BILLING_REQUIRED: ${{ secrets.STRIPE_BILLING_REQUIRED }}
-          STRIPE_API_KEY: ${{ secrets.STRIPE_API_KEY }}
-          STRIPE_WEBHOOK_SECRET: ${{ secrets.STRIPE_WEBHOOK_SECRET }}
-          REGISTRY_USERNAME: ${{ secrets.REGISTRY_USERNAME }}
-          REGISTRY_USER: ${{ secrets.REGISTRY_USER }}
-          REGISTRY_PASSWORD: ${{ secrets.REGISTRY_PASSWORD }}
-          REGISTRY_TOKEN: ${{ secrets.REGISTRY_TOKEN }}
-          REMOTE_BUILD_DIR: ${{ env.DEPLOY_ROOT }}/build-context
-          VPS_HOST: ${{ secrets.VPS_IP }}
-        run: |
-          VPS_HOST="${VPS_HOST:-$DEPLOY_SSH_HOST}"
-          if [ -z "$VPS_HOST" ]; then
-            echo "::error::VPS_IP secret or DEPLOY_SSH_HOST is required"
-            exit 1
-          fi
-          SSH_OPTIONS="-i $HOME/.ssh/id_rsa -o BatchMode=yes -o IdentitiesOnly=yes -o StrictHostKeyChecking=accept-new -o UserKnownHostsFile=$HOME/.ssh/known_hosts"
-          ENV_DOCKER_PRODUCTION_B64_CLEAN="$(printf '%s' "$ENV_DOCKER_PRODUCTION_B64" | tr -d '[:space:]')"
-          ENV_DOCKER_PRODUCTION_RAW_B64="$(printf '%s' "$ENV_DOCKER_PRODUCTION" | base64 | tr -d '\n')"
-          STRIPE_BILLING_REQUIRED="${STRIPE_BILLING_REQUIRED:-false}"
-          STRIPE_BILLING_REQUIRED_B64="$(printf '%s' "$STRIPE_BILLING_REQUIRED" | base64 | tr -d '\n')"
-          STRIPE_API_KEY_B64="$(printf '%s' "$STRIPE_API_KEY" | base64 | tr -d '\n')"
-          STRIPE_WEBHOOK_SECRET_B64="$(printf '%s' "$STRIPE_WEBHOOK_SECRET" | base64 | tr -d '\n')"
-          REGISTRY_USERNAME="${REGISTRY_USERNAME:-${REGISTRY_USER:-}}"
-          REGISTRY_PASSWORD="${REGISTRY_PASSWORD:-${REGISTRY_TOKEN:-}}"
-          REGISTRY_PASSWORD_B64="$(printf '%s' "$REGISTRY_PASSWORD" | base64 | tr -d '\n')"
-          ssh $SSH_OPTIONS "${{ secrets.VPS_USER }}@$VPS_HOST" "
-            set -e
-            mkdir -p '$DEPLOY_ROOT' '$REMOTE_BUILD_DIR'
-            previous_env_file=''
-            if [ -f '$DEPLOY_ROOT/.env.docker.production' ]; then
-              previous_env_file=\"\$(mktemp)\"
-              cp '$DEPLOY_ROOT/.env.docker.production' \"\$previous_env_file\"
-              trap 'rm -f \"\$previous_env_file\"' EXIT
-            fi
-            if [ -n '$ENV_DOCKER_PRODUCTION_B64_CLEAN' ]; then
-              printf '%s' '$ENV_DOCKER_PRODUCTION_B64_CLEAN' | base64 -d > '$DEPLOY_ROOT/.env.docker.production'
-              chmod 600 '$DEPLOY_ROOT/.env.docker.production'
-            elif [ -n '$ENV_DOCKER_PRODUCTION_RAW_B64' ]; then
-              printf '%s' '$ENV_DOCKER_PRODUCTION_RAW_B64' | base64 -d > '$DEPLOY_ROOT/.env.docker.production'
-              chmod 600 '$DEPLOY_ROOT/.env.docker.production'
-            elif [ ! -f '$DEPLOY_ROOT/.env.docker.production' ]; then
-              echo 'ENV_DOCKER_PRODUCTION or ENV_DOCKER_PRODUCTION_B64 is not set, and $DEPLOY_ROOT/.env.docker.production does not exist on the VPS' >&2
-              exit 1
-            else
-              echo 'Using existing $DEPLOY_ROOT/.env.docker.production on the VPS'
-            fi
-            cp '$DEPLOY_ROOT/.env.docker.production' '$REMOTE_BUILD_DIR/.env.docker.production'
-            chmod 600 '$REMOTE_BUILD_DIR/.env.docker.production'
-            cd '$REMOTE_BUILD_DIR'
-            if [ -n \"\$previous_env_file\" ]; then
-              bash scripts/preserve-env-values.sh \"\$previous_env_file\" .env.docker.production STRIPE_BILLING_REQUIRED STRIPE_API_KEY STRIPE_WEBHOOK_SECRET
-            fi
-            export STRIPE_BILLING_REQUIRED_B64='$STRIPE_BILLING_REQUIRED_B64'
-            export STRIPE_API_KEY_B64='$STRIPE_API_KEY_B64'
-            export STRIPE_WEBHOOK_SECRET_B64='$STRIPE_WEBHOOK_SECRET_B64'
-            bash scripts/apply-env-secret-overrides.sh .env.docker.production STRIPE_BILLING_REQUIRED STRIPE_API_KEY STRIPE_WEBHOOK_SECRET
-            bash scripts/describe-env-values.sh .env.docker.production STRIPE_BILLING_REQUIRED STRIPE_API_KEY STRIPE_WEBHOOK_SECRET
-            cp .env.docker.production '$DEPLOY_ROOT/.env.docker.production'
-            chmod 600 '$DEPLOY_ROOT/.env.docker.production'
-            export APP_IMAGE='$DEPLOY_REGISTRY_HOST/$IMAGE_REPOSITORY'
-            export IMAGE_TAG='$IMAGE_TAG'
-            export REGISTRY_HOST='$DEPLOY_REGISTRY_HOST'
-            export REGISTRY_USER='$REGISTRY_USERNAME'
-            export REGISTRY_PASSWORD=\"\$(printf '%s' '$REGISTRY_PASSWORD_B64' | base64 -d)\"
-            bash scripts/docker-prod-deploy.sh
-          "