diff --git a/.github/workflows/ci-cd-web-desktop.yml b/.github/workflows/ci-cd-web-desktop.yml
index bf2c48f..5dd2c1b 100644
--- a/.github/workflows/ci-cd-web-desktop.yml
+++ b/.github/workflows/ci-cd-web-desktop.yml
@@ -292,8 +292,8 @@ jobs:
   convex_deploy:
     name: Deploy Convex functions
     needs: changes
-    # Executa em workflow_dispatch, push na main, ou quando convex/** mudar
-    if: ${{ github.event_name == 'workflow_dispatch' || github.ref == 'refs/heads/main' || needs.changes.outputs.convex == 'true' }}
+    # Executa quando convex/** mudar ou via workflow_dispatch
+    if: ${{ github.event_name == 'workflow_dispatch' || needs.changes.outputs.convex == 'true' }}
     runs-on: [ self-hosted, linux, vps ]
     env:
       APP_DIR: /srv/apps/sistema
@@ -311,15 +311,6 @@ jobs:
           echo "Using APP_DIR (fallback)=$FALLBACK_DIR"
           echo "EFFECTIVE_APP_DIR=$FALLBACK_DIR" >> "$GITHUB_ENV"
 
-      - name: Validate secrets present (Convex)
-        env:
-          CONVEX_SELF_HOSTED_URL: ${{ secrets.CONVEX_SELF_HOSTED_URL }}
-          CONVEX_SELF_HOSTED_ADMIN_KEY: ${{ secrets.CONVEX_SELF_HOSTED_ADMIN_KEY }}
-        run: |
-          set -e
-          if [ -z "${CONVEX_SELF_HOSTED_URL:-}" ]; then echo "Missing secret: CONVEX_SELF_HOSTED_URL" >&2; exit 1; fi
-          if [ -z "${CONVEX_SELF_HOSTED_ADMIN_KEY:-}" ]; then echo "Missing secret: CONVEX_SELF_HOSTED_ADMIN_KEY" >&2; exit 1; fi
-
       - name: Sync workspace to APP_DIR (preserving local env)
         run: |
           mkdir -p "$EFFECTIVE_APP_DIR"
@@ -344,8 +335,8 @@ jobs:
 
       - name: Set Convex env vars (self-hosted)
         env:
-          CONVEX_SELF_HOSTED_URL: ${{ secrets.CONVEX_SELF_HOSTED_URL }}
-          CONVEX_SELF_HOSTED_ADMIN_KEY: ${{ secrets.CONVEX_SELF_HOSTED_ADMIN_KEY }}
+          CONVEX_SELF_HOSTED_URL: https://convex.esdrasrenan.com.br
+          CONVEX_SELF_HOSTED_ADMIN_KEY: ${{ steps.key.outputs.ADMIN_KEY }}
           MACHINE_PROVISIONING_SECRET: ${{ secrets.MACHINE_PROVISIONING_SECRET }}
           MACHINE_TOKEN_TTL_MS: ${{ secrets.MACHINE_TOKEN_TTL_MS }}
           FLEET_SYNC_SECRET: ${{ secrets.FLEET_SYNC_SECRET }}
@@ -375,8 +366,8 @@ jobs:
           fi
       - name: Deploy functions to Convex self-hosted
         env:
-          CONVEX_SELF_HOSTED_URL: ${{ secrets.CONVEX_SELF_HOSTED_URL }}
-          CONVEX_SELF_HOSTED_ADMIN_KEY: ${{ secrets.CONVEX_SELF_HOSTED_ADMIN_KEY }}
+          CONVEX_SELF_HOSTED_URL: https://convex.esdrasrenan.com.br
+          CONVEX_SELF_HOSTED_ADMIN_KEY: ${{ steps.key.outputs.ADMIN_KEY }}
         run: |
           docker run --rm -i \
             -v "$EFFECTIVE_APP_DIR":/app \