diff --git a/.github/workflows/ci-cd-web-desktop.yml b/.github/workflows/ci-cd-web-desktop.yml
index 2e05b52..2875928 100644
--- a/.github/workflows/ci-cd-web-desktop.yml
+++ b/.github/workflows/ci-cd-web-desktop.yml
@@ -187,11 +187,8 @@ jobs:
   convex_deploy:
     name: Deploy Convex functions
     needs: changes
-    # Executa quando:
-    # - Disparo manual (workflow_dispatch) — sem exigir input
-    # - Push na main com secrets presentes (deploy automático)
-    # - Ou quando houver mudanças em convex/** detectadas pelo filtro
-    if: ${{ github.event_name == 'workflow_dispatch' || (github.ref == 'refs/heads/main' && secrets.CONVEX_SELF_HOSTED_URL != '' && secrets.CONVEX_SELF_HOSTED_ADMIN_KEY != '') || needs.changes.outputs.convex == 'true' }}
+    # Executa em workflow_dispatch, push na main, ou quando convex/** mudar
+    if: ${{ github.event_name == 'workflow_dispatch' || github.ref == 'refs/heads/main' || needs.changes.outputs.convex == 'true' }}
     runs-on: [ self-hosted, linux, vps ]
     env:
       APP_DIR: /srv/apps/sistema
@@ -235,12 +232,16 @@ jobs:
             $EXCLUDE_ENV \
             ./ "$EFFECTIVE_APP_DIR"/
       - name: Deploy functions to Convex self-hosted
+        if: ${{ env.CONVEX_SELF_HOSTED_URL != '' && env.CONVEX_SELF_HOSTED_ADMIN_KEY != '' }}
+        env:
+          CONVEX_SELF_HOSTED_URL: ${{ secrets.CONVEX_SELF_HOSTED_URL }}
+          CONVEX_SELF_HOSTED_ADMIN_KEY: ${{ secrets.CONVEX_SELF_HOSTED_ADMIN_KEY }}
         run: |
           docker run --rm -i \
             -v "$EFFECTIVE_APP_DIR":/app \
             -w /app \
-            -e CONVEX_SELF_HOSTED_URL="${{ secrets.CONVEX_SELF_HOSTED_URL }}" \
-            -e CONVEX_SELF_HOSTED_ADMIN_KEY="${{ secrets.CONVEX_SELF_HOSTED_ADMIN_KEY }}" \
+            -e CONVEX_SELF_HOSTED_URL \
+            -e CONVEX_SELF_HOSTED_ADMIN_KEY \
             node:20-bullseye bash -lc "corepack enable && corepack prepare pnpm@9 --activate && pnpm install --frozen-lockfile --prod=false && pnpm exec convex deploy"
 
   desktop_release: