diff --git a/.woodpecker.yml b/.woodpecker.yml
index 2d0c1cc..24e3932 100644
--- a/.woodpecker.yml
+++ b/.woodpecker.yml
@@ -1,4 +1,4 @@
-# .woodpecker.yml – aktualna wersja dla Woodpecker 3.x (2026)
+# .woodpecker.yml – deploy via SSH (bez volumes i bez Trusted)
 
 when:
   event: [push, tag]
@@ -22,13 +22,13 @@ steps:
 
   deploy:
     image: mcr.microsoft.com/dotnet/sdk:latest
-    volumes:
-      - /opt/deployment:/deploy-host   # Host mount – wymaga "Trusted" repo!
     environment:
       BAGET_API_KEY:
-        from_secret: baget_api_key     # Nowa składnia secrets
+        from_secret: baget_api_key
       BAGET_URL:
         from_secret: baget_url
+      DEPLOY_SSH_KEY:
+        from_secret: deploy_ssh_key
     commands:
       - |
         set -euo pipefail
@@ -81,12 +81,20 @@ steps:
 
             dotnet publish $PUBLISH_ARGS
 
-            TARGET_DIR="/deploy-host/$PROJECT_TYPE/${CI_REPO_NAME}"
-            mkdir -p "$TARGET_DIR"
-            cp -r /tmp/publish/* "$TARGET_DIR/"
-            find "$TARGET_DIR" -type f \( -name "*.dll" -o -name "*.exe" -o -perm /111 \) -exec chmod +x {} \; 2>/dev/null || true
+            echo "Przygotowanie SSH do deployu na localhost"
+            mkdir -p ~/.ssh
+            echo "$DEPLOY_SSH_KEY" > ~/.ssh/id_rsa
+            chmod 600 ~/.ssh/id_rsa
+            ssh-keyscan -H localhost >> ~/.ssh/known_hosts 2>/dev/null
 
-            echo "Deploy zakończony → $TARGET_DIR"
+            TARGET_DIR="/opt/deployment/$PROJECT_TYPE/${CI_REPO_NAME}"
+            echo "Deploy via rsync do $TARGET_DIR"
+
+            rsync -avz --delete /tmp/publish/ "$(whoami)@localhost:$TARGET_DIR/"
+
+            ssh "$(whoami)@localhost" "find '$TARGET_DIR' -type f \\( -name '*.dll' -o -name '*.exe' -o -perm /111 \\) -exec chmod +x {} \\; 2>/dev/null || true"
+
+            echo "Deploy $PROJECT_TYPE zakończony pomyślnie → $TARGET_DIR"
             ;;
 
           *)