diff --git a/.gitea/workflows/deploy.yml b/.gitea/workflows/deploy.yml
index 30e60b0..66ad4b1 100644
--- a/.gitea/workflows/deploy.yml
+++ b/.gitea/workflows/deploy.yml
@@ -18,8 +18,16 @@ jobs:
           set -euo pipefail
           mkdir -p ~/.ssh
           chmod 700 ~/.ssh
-          printf "%s" "$DEPLOY_SSH_KEY" > ~/.ssh/id_ed25519
+
+          # Accept raw private key or base64-encoded private key in DEPLOY_SSH_KEY.
+          if printf "%s" "$DEPLOY_SSH_KEY" | grep -q "BEGIN OPENSSH PRIVATE KEY"; then
+            printf "%s\n" "$DEPLOY_SSH_KEY" | tr -d '\r' > ~/.ssh/id_ed25519
+          else
+            printf "%s" "$DEPLOY_SSH_KEY" | tr -d '\r' | base64 -d > ~/.ssh/id_ed25519
+          fi
+
           chmod 600 ~/.ssh/id_ed25519
+          ssh-keygen -y -f ~/.ssh/id_ed25519 >/dev/null
           ssh-keyscan -p "${DEPLOY_PORT:-22}" -H "$DEPLOY_HOST" >> ~/.ssh/known_hosts
 
       - name: Deploy latest main