diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml
index c906ba1..2c96ca2 100644
--- a/.github/workflows/deploy.yml
+++ b/.github/workflows/deploy.yml
@@ -168,8 +168,6 @@ By: \`${{ github.actor }}\`"
     runs-on: ubuntu-latest
     needs: quality-gates
     if: needs.quality-gates.result == 'success'
-    environment:
-      name: production
 
     env:
       DEPLOY_PASS: ${{ secrets.DEPLOY_PASS }}
diff --git a/deploy.sh b/deploy.sh
index 8100374..ed03293 100755
--- a/deploy.sh
+++ b/deploy.sh
@@ -38,17 +38,18 @@ say "Date:    $(date -u '+%Y-%m-%dT%H:%M:%SZ')"
 cd "$PROJECT_DIR"
 
 # ---------------------------------------------------------
-# Load only the variables needed for Telegram notifications.
-# Using set -o allexport would export every line in .env
-# (including unrelated or potentially sensitive variables).
-# Instead, extract only BOT_TOKEN and ADMIN_IDS explicitly.
-# ---------------------------------------------------------
-if [[ -f "$PROJECT_DIR/.env" ]]; then
-    _env_file="$PROJECT_DIR/.env"
-    BOT_TOKEN="$(grep -E '^BOT_TOKEN=' "$_env_file" | head -1 | cut -d= -f2- | tr -d '"'"'"' | tr -d $'\r')" || true
-    ADMIN_IDS="$(grep -E '^ADMIN_IDS=' "$_env_file" | head -1 | cut -d= -f2- | tr -d '"'"'"' | tr -d $'\r')" || true
-    export BOT_TOKEN ADMIN_IDS
+# Load BOT_TOKEN and ADMIN_IDS for Telegram notifications.
+# When deploy.sh is spawned from the bot process (source=bot),
+# these are already inherited via process.env — don't overwrite.
+# When invoked from GitHub Actions or a cron, parse from .env.
+# ---------------------------------------------------------
+if [[ -z "${BOT_TOKEN:-}" && -f "$PROJECT_DIR/.env" ]]; then
+    BOT_TOKEN="$(grep -E '^BOT_TOKEN=' "$PROJECT_DIR/.env" | head -1 | cut -d= -f2- | sed "s/^['\"]//;s/['\"]$//" | tr -d $'\r')" || true
+fi
+if [[ -z "${ADMIN_IDS:-}" && -f "$PROJECT_DIR/.env" ]]; then
+    ADMIN_IDS="$(grep -E '^ADMIN_IDS=' "$PROJECT_DIR/.env" | head -1 | cut -d= -f2- | sed "s/^['\"]//;s/['\"]$//" | tr -d $'\r')" || true
 fi
+export BOT_TOKEN ADMIN_IDS
 
 # ---------------------------------------------------------
 # Silent Telegram admin notification helper
diff --git a/index.js b/index.js
index 619c439..219026c 100644
--- a/index.js
+++ b/index.js
@@ -2623,11 +2623,17 @@ bot.command('deploy', async (ctx) => {
 
   // Spawn deploy.sh detached — it stops + restarts the service,
   // sends per-step Telegram notifications via curl, and handles errors.
+  // Pass the bot's full environment so deploy.sh inherits BOT_TOKEN and
+  // ADMIN_IDS and its send_admin() calls actually reach Telegram.
   const deployScript = path.join(PROJECT_DIR, 'deploy.sh');
   const deployProc = spawn('bash', [deployScript, 'bot'], {
     detached: true,
     stdio:    'ignore',
     cwd:      PROJECT_DIR,
+    env: {
+      ...process.env,
+      PATH: process.env.PATH || '/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin',
+    },
   });
   deployProc.unref();
 
diff --git a/scripts/disk-protect.sh b/scripts/disk-protect.sh
index 9f28683..40c5cb4 100755
--- a/scripts/disk-protect.sh
+++ b/scripts/disk-protect.sh
@@ -94,7 +94,7 @@ fi
 # ── 5. Clear npm cache ─────────────────────────────────────────────────────────
 log "Step 5: Clear npm cache"
 if command -v npm >/dev/null 2>&1; then
-    npm cache clean --force 2>&1 | tail -1 | while IFS= read -r line; do log "  [npm] $line"; done
+    npm cache clean --force 2>&1 | tail -1 | while IFS= read -r line; do log "  [npm] $line"; done || true
     log "  npm cache cleared"
 else
     log "  npm not found — skipping"