diff --git a/.gitea/scripts/deploy-nexus.sh b/.gitea/scripts/deploy-nexus.sh
index 118eb78..0c06348 100755
--- a/.gitea/scripts/deploy-nexus.sh
+++ b/.gitea/scripts/deploy-nexus.sh
@@ -3,18 +3,13 @@ set -eu
 
 DEPLOY_PATH="${DEPLOY_PATH:-/home/projekte_bao/nexus}"
 ENV_TMPFILE_TEMPLATE="${ENV_TMPFILE:-/tmp/nexus-deploy-env}"
-COMPOSE_SCRIPT_TEMPLATE="${COMPOSE_SCRIPT:-/tmp/nexus-compose-deploy.sh}"
 ENV_TMPFILE=""
-COMPOSE_SCRIPT=""
 BASE_URL="${BASE_URL:-https://nexus.noveria.net}"
 
 cleanup() {
   if [ -n "$ENV_TMPFILE" ] && [ -f "$ENV_TMPFILE" ]; then
     shred -u "$ENV_TMPFILE" 2>/dev/null || rm -f "$ENV_TMPFILE"
   fi
-  if [ -n "$COMPOSE_SCRIPT" ]; then
-    rm -f "$COMPOSE_SCRIPT"
-  fi
 }
 trap cleanup EXIT INT TERM
 
@@ -39,8 +34,7 @@ secure_tmpfile() {
 }
 
 ENV_TMPFILE="$(secure_tmpfile "$ENV_TMPFILE_TEMPLATE")"
-COMPOSE_SCRIPT="$(secure_tmpfile "$COMPOSE_SCRIPT_TEMPLATE")"
-chmod 600 "$ENV_TMPFILE" "$COMPOSE_SCRIPT"
+chmod 600 "$ENV_TMPFILE"
 
 if [ ! -f VERSION ]; then
   echo "VERSION file not found" >&2
@@ -112,24 +106,20 @@ git archive --format=tar HEAD | docker run --rm -i \
   '
 
 echo "Building and starting Docker compose stack"
-cat > "$COMPOSE_SCRIPT" <<'EOF_DEPLOY'
-#!/bin/sh
-set -eu
-cat > /tmp/nexus-deploy-env
-docker compose --env-file /tmp/nexus-deploy-env build
-docker compose --env-file /tmp/nexus-deploy-env up -d --force-recreate --remove-orphans --wait
-docker compose --env-file /tmp/nexus-deploy-env ps
-rm -f /tmp/nexus-deploy-env
-EOF_DEPLOY
-
 docker run --rm \
   -v "$DEPLOY_PATH:/workspace/nexus" \
   -v /var/run/docker.sock:/var/run/docker.sock \
-  -v "$COMPOSE_SCRIPT:/deploy.sh:ro" \
   -w /workspace/nexus \
   -i \
   docker:cli \
-  sh /deploy.sh < "$ENV_TMPFILE"
+  sh -c 'set -eu
+    umask 077
+    cat > /tmp/nexus-deploy-env
+    trap '\''rm -f /tmp/nexus-deploy-env'\'' EXIT INT TERM
+    docker compose --env-file /tmp/nexus-deploy-env build
+    docker compose --env-file /tmp/nexus-deploy-env up -d --force-recreate --remove-orphans --wait
+    docker compose --env-file /tmp/nexus-deploy-env ps
+  ' < "$ENV_TMPFILE"
 
 echo "Verifying image provenance"
 for container in nexus-api-1 nexus-web-1; do