diff --git a/.gitea/workflows/deploy.yml b/.gitea/workflows/deploy.yml
index d186947..3c6caa6 100644
--- a/.gitea/workflows/deploy.yml
+++ b/.gitea/workflows/deploy.yml
@@ -79,24 +79,17 @@ jobs:
       - name: Add optional PEM secrets to .env
         run: |
           ENV_FILE=".kamal/secrets.${{ inputs.environment }}"
+          mkdir -p "$(dirname "$ENV_FILE")"
+          touch "$ENV_FILE"
 
-          # Add certificate-pem if present
           if [[ -n "${{ secrets.certificate-pem }}" ]]; then
-            {
-              echo "";
-              echo "CERTIFICATE_PEM='";
-              echo "${{ secrets.certificate-pem }}";
-              echo "'";
-            } >> "$ENV_FILE"
+            echo "" >> "$ENV_FILE"
+            echo "CERTIFICATE_PEM=\"$(echo "${{ secrets.certificate-pem }}" | awk '{printf "%s\\n", $0}')\"" >> "$ENV_FILE"
           fi
 
           if [[ -n "${{ secrets.private-key-pem }}" ]]; then
-            {
-              echo "";
-              echo "PRIVATE_KEY_PEM='";
-              echo "${{ secrets.private-key-pem }}";
-              echo "'";
-            } >> "$ENV_FILE"
+            echo "" >> "$ENV_FILE"
+            echo "PRIVATE_KEY_PEM=\"$(echo "${{ secrets.private-key-pem }}" | awk '{printf "%s\\n", $0}')\"" >> "$ENV_FILE"
           fi
 
       - name: Boot accessories