diff --git a/deploy.sh b/deploy.sh
index a82777f..74497c5 100755
--- a/deploy.sh
+++ b/deploy.sh
@@ -1,6 +1,11 @@
 #!/usr/bin/env bash
 set -euo pipefail
 
+# ── Decrypt secrets ───────────────────────────────────────
+export SOPS_AGE_KEY_FILE="${SOPS_AGE_KEY_FILE:-/opt/padelnomics/age-key.txt}"
+sops --input-type dotenv --output-type dotenv -d .env.prod.sops > .env
+chmod 600 .env
+
 COMPOSE="docker compose -f docker-compose.prod.yml"
 LIVE_FILE=".live-slot"
 ROUTER_CONF="router/default.conf"