diff --git a/.gitea/workflows/deploy-dev.yml b/.gitea/workflows/deploy-dev.yml
index f08ef4d..3a64348 100644
--- a/.gitea/workflows/deploy-dev.yml
+++ b/.gitea/workflows/deploy-dev.yml
@@ -25,13 +25,12 @@ jobs:
             git reset --hard origin/develop
           fi
           if [ ! -f .env ]; then
-            cat > .env <<'EOF'
-DB_NAME=buyingagent_dev
-DB_USER=buyingagent_dev
-DB_PASSWORD=dev_password_change_me
-ENVIRONMENT=development
-BUYING_AGENT_API_PORT=8095
-EOF
+            printf '%s\n' \
+              'DB_NAME=buyingagent_dev' \
+              'DB_USER=buyingagent_dev' \
+              'DB_PASSWORD=dev_password_change_me' \
+              'ENVIRONMENT=development' \
+              'BUYING_AGENT_API_PORT=8095' > .env
             echo "created development .env"
           fi
           if grep -q '^BUYING_AGENT_API_PORT=' .env; then
diff --git a/.gitea/workflows/deploy-prod.yml b/.gitea/workflows/deploy-prod.yml
index 67d2da9..f209ad1 100644
--- a/.gitea/workflows/deploy-prod.yml
+++ b/.gitea/workflows/deploy-prod.yml
@@ -25,14 +25,13 @@ jobs:
             git reset --hard origin/main
           fi
           if [ ! -f .env ]; then
-            cat > .env <<'EOF'
-DB_NAME=buyingagent
-DB_USER=buyingagent
-DB_PASSWORD=change_me
-ENVIRONMENT=production
-BUYING_AGENT_API_BIND=0.0.0.0
-BUYING_AGENT_API_PORT=8006
-EOF
+            printf '%s\n' \
+              'DB_NAME=buyingagent' \
+              'DB_USER=buyingagent' \
+              'DB_PASSWORD=change_me' \
+              'ENVIRONMENT=production' \
+              'BUYING_AGENT_API_BIND=0.0.0.0' \
+              'BUYING_AGENT_API_PORT=8006' > .env
             echo "created production .env — set a unique DB_PASSWORD after first start"
           fi
           if grep -q '^BUYING_AGENT_API_BIND=' .env; then