diff --git a/.drone.yml b/.drone.yml
index ec21024..7d68a7a 100644
--- a/.drone.yml
+++ b/.drone.yml
@@ -2,14 +2,12 @@ kind: pipeline
 type: kubernetes
 name: deploy-backend
 
-# 🚨 ESSENCIAL
-service_account_name: drone-runner
+# ✅ SERVICE ACCOUNT CORRETO (CLUSTER-WIDE)
+service_account_name: drone-deployer
 
 steps:
   - name: build-and-push-backend
     image: plugins/docker:latest
-    environment:
-      HOME: /tmp/drone-home
     settings:
       registry: in.gohorsejobs.com
       repo: in.gohorsejobs.com/gohorsejobs/gohorsejobs-backend
@@ -23,14 +21,10 @@ steps:
         from_secret: HARBOR_USERNAME
       password:
         from_secret: HARBOR_PASSWORD
-    commands:
-      - mkdir -p /tmp/drone-home
 
   - name: export-envs-to-k8s
     image: bitnami/kubectl:latest
     environment:
-      HOME: /tmp/drone-home
-
       AWS_ACCESS_KEY_ID:        { from_secret: AWS_ACCESS_KEY_ID }
       AWS_ENDPOINT:             { from_secret: AWS_ENDPOINT }
       AWS_REGION:               { from_secret: AWS_REGION }
@@ -50,36 +44,33 @@ steps:
       UPLOAD_DIR:               { from_secret: UPLOAD_DIR }
 
     commands:
-      - mkdir -p /tmp/drone-home
-
-      - echo "AWS_ACCESS_KEY_ID=$AWS_ACCESS_KEY_ID"          >  .env.k8s
-      - echo "AWS_ENDPOINT=$AWS_ENDPOINT"                   >> .env.k8s
-      - echo "AWS_REGION=$AWS_REGION"                       >> .env.k8s
-      - echo "AWS_SECRET_ACCESS_KEY=$AWS_SECRET_ACCESS_KEY" >> .env.k8s
-      - echo "CORS_ORIGINS=$CORS_ORIGINS"                   >> .env.k8s
-      - echo "DB_HOST=$DB_HOST"                             >> .env.k8s
-      - echo "DB_NAME=$DB_NAME"                             >> .env.k8s
-      - echo "DB_PASSWORD=$DB_PASSWORD"                     >> .env.k8s
-      - echo "DB_PORT=$DB_PORT"                             >> .env.k8s
-      - echo "DB_SSLMODE=$DB_SSLMODE"                       >> .env.k8s
-      - echo "DB_USER=$DB_USER"                             >> .env.k8s
-      - echo "ENV=$ENV"                                     >> .env.k8s
-      - echo "JWT_SECRET=$JWT_SECRET"                       >> .env.k8s
-      - echo "MAX_UPLOAD_CAD_SIZE=$MAX_UPLOAD_CAD_SIZE"     >> .env.k8s
-      - echo "PORT=$PORT"                                   >> .env.k8s
-      - echo "S3_BUCKET=$S3_BUCKET"                         >> .env.k8s
-      - echo "UPLOAD_DIR=$UPLOAD_DIR"                       >> .env.k8s
+      - |
+        cat <<EOF > .env.k8s
+        AWS_ACCESS_KEY_ID=$AWS_ACCESS_KEY_ID
+        AWS_ENDPOINT=$AWS_ENDPOINT
+        AWS_REGION=$AWS_REGION
+        AWS_SECRET_ACCESS_KEY=$AWS_SECRET_ACCESS_KEY
+        CORS_ORIGINS=$CORS_ORIGINS
+        DB_HOST=$DB_HOST
+        DB_NAME=$DB_NAME
+        DB_PASSWORD=$DB_PASSWORD
+        DB_PORT=$DB_PORT
+        DB_SSLMODE=$DB_SSLMODE
+        DB_USER=$DB_USER
+        ENV=$ENV
+        JWT_SECRET=$JWT_SECRET
+        MAX_UPLOAD_CAD_SIZE=$MAX_UPLOAD_CAD_SIZE
+        PORT=$PORT
+        S3_BUCKET=$S3_BUCKET
+        UPLOAD_DIR=$UPLOAD_DIR
+        EOF
 
       - kubectl -n gohorsejobs delete secret backend-secrets --ignore-not-found
       - kubectl -n gohorsejobs create secret generic backend-secrets --from-env-file=.env.k8s
 
   - name: deploy-backend
     image: bitnami/kubectl:latest
-    environment:
-      HOME: /tmp/drone-home
     commands:
-      - mkdir -p /tmp/drone-home
-
       - kubectl get pods -n gohorsejobs
       - kubectl apply -n gohorsejobs -f k8s/backend-deployment.yaml
       - kubectl apply -n gohorsejobs -f k8s/backend-service.yaml