diff --git a/.gitea/workflows/deploy.yml b/.gitea/workflows/deploy.yml
index 4a45b5e..b82162a 100644
--- a/.gitea/workflows/deploy.yml
+++ b/.gitea/workflows/deploy.yml
@@ -65,10 +65,6 @@ on:
       VAULT_ROLE:
         description: 'Vault role for authentication'
         required: true
-      # The path to the secrets in Vault (e.g., "secret/data/my-app my_secret").
-      VAULT_SECRETS_PATH:
-        description: 'Path to the secrets in Vault'
-        required: true
       # The URL of the Docker registry.
       DOCKER_REGISTRY:
         description: 'Docker Registry URL'
@@ -190,7 +186,7 @@ jobs:
           method: jwt
           jwt: ${{ job.id_token }}
           secrets: |
-            ${{ secrets.VAULT_SECRETS_PATH }} env_data | DOTENV_CONTENTS
+            secret/data/${{ inputs.app_name }}/${{ inputs.deploy_env }} * | DOTENV_CONTENTS
 
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@v3
@@ -228,6 +224,9 @@ jobs:
   deploy:
     runs-on: ubuntu-22.04
     needs: [prepare, build] # This job runs only after 'prepare' and 'build' jobs succeed.
+    permissions:
+      id-token: write
+      contents: read
     steps:
       - name: Checkout Application Code
         uses: actions/checkout@v4
@@ -255,8 +254,27 @@ jobs:
           echo "StrictHostKeyChecking no" >> ~/.ssh/config
 
       - name: Setup Ansible Vault
+        working-directory: .ansible
         run: |
-          echo "${{ secrets.VAULT_PASSWORD }}" > .ansible/.vault_pass
+          echo "${{ secrets.VAULT_PASSWORD }}" > .vault_pass
+
+      - name: Import App Secrets from HashiCorp Vault
+        id: vault
+        uses: hashicorp/vault-action@v2
+        with:
+          url: ${{ secrets.VAULT_ADDR }}
+          role: ${{ secrets.VAULT_ROLE }}
+          method: jwt
+          jwt: ${{ job.id_token }}
+          secrets: |
+            secret/data/${{ inputs.app_name }}/${{ inputs.deploy_env }} * | app_secrets
+
+      - name: Create Ansible secret file
+        run: |
+          ANSIBLE_PROJECT_DIR=".ansible/projects/${{ inputs.app_name }}"
+          mkdir -p "${ANSIBLE_PROJECT_DIR}/templates"
+          echo "${{ steps.vault.outputs.app_secrets }}" > "${ANSIBLE_PROJECT_DIR}/templates/.env.j2"
+          echo "✅ Created .env.j2 for Ansible"
 
       - name: Run Ansible Playbook
         working-directory: .ansible
@@ -280,14 +298,14 @@ jobs:
             -i "$SERVER_HOST," \
             --extra-vars "app_name=${{ inputs.app_name }} \
                           deploy_env=${{ inputs.deploy_env }} \
-                          server_user=${{ inputs.server_user }} \
-                          server_port=${{ inputs.server_port }} \
+                          server_user=${{ secrets.SERVER_USER }} \
+                          server_port=${{ secrets.SERVER_PORT }} \
                           server_host=$SERVER_HOST \
                           git_repo=${{ github.server_url }}/${{ github.repository }} \
                           framework=${{ needs.prepare.outputs.framework }} \
                           docker_image_tag=${{ needs.build.outputs.image_tag }} \
                           docker_image_name=${{ needs.build.outputs.image_name }} \
                           docker_image_full=${{ needs.build.outputs.image_name }}:${{ needs.build.outputs.image_tag }} \
-                          docker_registry=${{ inputs.DOCKER_REGISTRY }} \
+                          docker_registry=${{ secrets.DOCKER_REGISTRY }} \
                           $auth_method_var" \
             --vault-password-file .vault_pass
\ No newline at end of file
diff --git a/.gitea/workflows/main.yml b/.gitea/workflows/main.yml
index e5650dc..a820ec1 100644
--- a/.gitea/workflows/main.yml
+++ b/.gitea/workflows/main.yml
@@ -33,7 +33,6 @@ jobs:
       SERVER_SSH_PRIVATE_KEY: ${{ (contains(github.ref_name, '-stg.')) && secrets.SERVER_SSH_PRIVATE_KEY_STG || (contains(github.ref_name, '-prod.')) && secrets.SERVER_SSH_PRIVATE_KEY_PROD || secrets.SERVER_SSH_PRIVATE_KEY_DEV || '' }}
       SERVER_PASSWORD: ${{ (contains(github.ref_name, '-stg.')) && secrets.SERVER_PASSWORD_STG || (contains(github.ref_name, '-prod.')) && secrets.SERVER_PASSWORD_PROD || secrets.SERVER_PASSWORD_DEV || '' }}
       VAULT_PASSWORD: ${{ secrets.VAULT_PASSWORD }}
-      VAULT_SECRETS_PATH: ${{ secrets.VAULT_SECRETS_PATH }}
       VAULT_ROLE: ${{ vars.VAULT_ROLE }}
       VAULT_ADDR: ${{ vars.VAULT_ADDR || 'https://vault.nguoiduathu.eu.org' }}
       DOCKER_REGISTRY: ${{ vars.DOCKER_REGISTRY || gitea.instance }}