diff --git a/.github/workflows/ci-cd-web-desktop.yml b/.github/workflows/ci-cd-web-desktop.yml
index 7be7c1e..8354f16 100644
--- a/.github/workflows/ci-cd-web-desktop.yml
+++ b/.github/workflows/ci-cd-web-desktop.yml
@@ -185,6 +185,27 @@ jobs:
           set +o allexport
           APP_DIR="$EFFECTIVE_APP_DIR" RELEASE_SHA=${{ github.sha }} docker stack deploy --with-registry-auth -c stack.yml sistema
 
+      - name: Ensure Convex service envs and restart
+        run: |
+          cd "$EFFECTIVE_APP_DIR"
+          set -o allexport
+          if [ -f .env ]; then . ./.env; fi
+          set +o allexport
+          echo "Ensuring Convex envs on service: sistema_convex_backend"
+          if [ -n "${MACHINE_PROVISIONING_SECRET:-}" ]; then
+            docker service update --env-add MACHINE_PROVISIONING_SECRET="${MACHINE_PROVISIONING_SECRET}" sistema_convex_backend || true
+          fi
+          if [ -n "${MACHINE_TOKEN_TTL_MS:-}" ]; then
+            docker service update --env-add MACHINE_TOKEN_TTL_MS="${MACHINE_TOKEN_TTL_MS}" sistema_convex_backend || true
+          fi
+          if [ -n "${FLEET_SYNC_SECRET:-}" ]; then
+            docker service update --env-add FLEET_SYNC_SECRET="${FLEET_SYNC_SECRET}" sistema_convex_backend || true
+          fi
+          echo "Current envs:" 
+          docker service inspect sistema_convex_backend --format '{{range .Spec.TaskTemplate.ContainerSpec.Env}}{{println .}}{{end}}' || true
+          echo "Forcing service restart..."
+          docker service update --force sistema_convex_backend || true
+
       - name: Restart web service with new code
         run: |
           docker service update --force sistema_web || true