diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml
index 2709882..d18b518 100644
--- a/.github/workflows/deploy.yml
+++ b/.github/workflows/deploy.yml
@@ -99,16 +99,12 @@ jobs:
           GITHUB_REDIRECT_URI=${{ secrets.GH_OAUTH_REDIRECT_URI || 'https://open-ten99.web.app/auth/github/callback' }}
           GITHUB_WEBHOOK_SECRET=${{ secrets.GH_WEBHOOK_SECRET || 'placeholder' }}
           POSTMARK_WEBHOOK_SECRET=${{ secrets.POSTMARK_WEBHOOK_SECRET || 'placeholder' }}
-          NOTION_CLIENT_ID=${{ secrets.NOTION_CLIENT_ID || 'placeholder' }}
-          NOTION_CLIENT_SECRET=${{ secrets.NOTION_CLIENT_SECRET || 'placeholder' }}
-          NOTION_REDIRECT_URI=${{ secrets.NOTION_REDIRECT_URI || 'https://open-ten99.web.app/auth/notion/callback' }}
-          STRIPE_WEBHOOK_SECRET=${{ secrets.STRIPE_WEBHOOK_SECRET || 'placeholder' }}
-          PLAID_CLIENT_ID=${{ secrets.PLAID_CLIENT_ID || 'placeholder' }}
-          PLAID_SECRET=${{ secrets.PLAID_SECRET || 'placeholder' }}
-          PLAID_ENV=${{ secrets.PLAID_ENV || 'sandbox' }}
-          TOKEN_ENCRYPTION_KEY=${{ secrets.TOKEN_ENCRYPTION_KEY || 'placeholder' }}
-          BREVO_API_KEY=${{ secrets.BREVO_API_KEY || 'placeholder' }}
           EOF
+          # NOTE: defineSecret-backed vars (NOTION_*, STRIPE_WEBHOOK_SECRET,
+          # PLAID_*, TOKEN_ENCRYPTION_KEY, BREVO_API_KEY) must NOT be written
+          # here — Cloud Run rejects an env var that is both a secret and a
+          # plain env var. They come from Secret Manager at runtime. Functions
+          # are deployed manually until those secrets are provisioned for CI.
 
       - id: auth
         uses: google-github-actions/auth@v2
@@ -120,11 +116,14 @@ jobs:
 
       - uses: google-github-actions/setup-gcloud@v2
 
-      - name: Deploy all
+      - name: Deploy hosting + rules
         env:
           FIREBASE_TOKEN: ${{ steps.auth.outputs.access_token }}
         run: |
+          # Functions are deployed manually (firebase deploy --only functions:NAME)
+          # because several functions use defineSecret params that are not yet
+          # provisioned in Secret Manager for the CI service account.
           npx -y firebase-tools@13 deploy \
-            --only hosting,functions,firestore \
+            --only hosting,firestore \
             --project open-ten99 \
             --non-interactive --force