diff --git a/.gitea/workflows/deploy.yml b/.gitea/workflows/deploy.yml
index 94788615..72c5db00 100644
--- a/.gitea/workflows/deploy.yml
+++ b/.gitea/workflows/deploy.yml
@@ -1,49 +1,74 @@
-name: Deploy to Staging
+name: Deploy EnCoach
 
-# Triggered on every push to main (after PR merge).
-# Runs ONLY the deploy job — not tests — so the server
-# always reflects the latest main without waiting for the
-# full CI suite to finish. The existing ci.yml handles lint/tests.
 on:
   push:
     branches: [main]
 
-concurrency:
-  group: deploy-backend
-  cancel-in-progress: true
-
 jobs:
   deploy:
-    name: Deploy backend + frontend to staging
-    runs-on: self-hosted
-
+    runs-on: ubuntu-latest
     steps:
       - name: Pull latest code
         run: |
-          cd /opt/encoach/encoach_backend_new_v2
-          git fetch origin
+          cd /opt/encoach/encoach_v4
+          git fetch origin main
           git reset --hard origin/main
-          echo "Now at: $(git log -1 --oneline)"
 
-      - name: Rebuild and restart containers
+      - name: Apply server-side patches
         run: |
-          cd /opt/encoach/encoach_backend_new_v2
-          docker compose \
-            -f docker-compose.yml \
-            -f /opt/encoach/overrides/encoach.override.yml \
-            up -d --build --remove-orphans
-          echo "Containers after deploy:"
-          docker ps --format "table {{.Names}}\t{{.Status}}" | grep -E "encoach-v4|encoach-frontend"
+          cd /opt/encoach/encoach_v4
+          # Fix pip for Debian Bookworm (developer runs macOS — his Dockerfile doesn't need these flags)
+          sed -i \
+            's|RUN pip3 install --no-cache-dir|RUN pip3 install --break-system-packages --no-cache-dir --ignore-installed typing_extensions|' \
+            backend/Dockerfile || true
+          # Ensure required Python packages are present
+          grep -q "sentence_transformers" backend/requirements.txt || \
+            echo "sentence_transformers>=2.7.0" >> backend/requirements.txt
+          echo "Dockerfile pip line:"; grep "pip3" backend/Dockerfile
+          echo "Extra packages:"; grep -E "langgraph|sentence" backend/requirements.txt
+
+      - name: Copy odoo.conf into build context
+        run: cp /opt/encoach/overrides/odoo.conf /opt/encoach/encoach_v4/backend/odoo.conf
+
+      - name: Build backend image
+        run: |
+          cd /opt/encoach/encoach_v4
+          docker compose -f docker-compose.yml -f /opt/encoach/overrides/encoach.override.yml build odoo
+
+      - name: Build frontend image
+        run: |
+          cd /opt/encoach/encoach_v4
+          docker compose -f docker-compose.yml -f /opt/encoach/overrides/encoach.override.yml build frontend
+
+      - name: Cleanup build context
+        run: rm -f /opt/encoach/encoach_v4/backend/odoo.conf
+
+      - name: Run DB migrations
+        run: |
+          MODULES=$(docker exec encoach-v4-db psql -U odoo -d encoach_v2 -tAc \
+            "SELECT string_agg(name, ',') FROM ir_module_module WHERE state='installed' AND name LIKE 'encoach%';")
+          echo "Upgrading: $MODULES"
+          docker run --rm \
+            --network encoach_v4_default \
+            -v /opt/encoach/overrides/odoo.conf:/etc/odoo/odoo.conf:ro \
+            -v /opt/encoach/encoach_v4/backend:/mnt/extra-addons:ro \
+            -v /opt/encoach/encoach_v4/backend/openeducat_erp-19.0/openeducat_erp-19.0:/mnt/extra-addons/openeducat_erp-19.0:ro \
+            -v encoach_backend_new_v2_odoo-web-data:/var/lib/odoo \
+            encoach-backend:latest \
+            odoo -u "$MODULES" --stop-after-init 2>&1 | tail -5
+
+      - name: Restart services
+        run: |
+          cd /opt/encoach/encoach_v4
+          docker compose -f docker-compose.yml -f /opt/encoach/overrides/encoach.override.yml \
+            up -d --no-deps odoo frontend
 
       - name: Smoke test
         run: |
-          echo "Waiting 20s for Odoo to settle..."
-          sleep 20
-          STATUS=$(curl -s -o /dev/null -w "%{http_code}" http://localhost:8069/api/health)
-          echo "/api/health => HTTP $STATUS"
-          if [ "$STATUS" != "200" ]; then
-            echo "WARNING: /api/health returned $STATUS (Odoo may still be starting)"
-          fi
-          FE=$(curl -s -o /dev/null -w "%{http_code}" http://localhost:3000/)
-          echo "frontend / => HTTP $FE"
-          test "$FE" = "200" || exit 1
+          for i in $(seq 1 12); do
+            CODE=$(curl -s -o /dev/null -w "%{http_code}" http://localhost:8069/api/health)
+            [ "$CODE" = "200" ] && echo "Health OK: HTTP $CODE" && exit 0
+            echo "Attempt $i: HTTP $CODE — waiting 10s..."
+            sleep 10
+          done
+          echo "Health check failed after 2 min" && exit 1