diff --git a/.gitea/workflows/deploy.yml b/.gitea/workflows/deploy.yml
index 4c1389b..82ec077 100644
--- a/.gitea/workflows/deploy.yml
+++ b/.gitea/workflows/deploy.yml
@@ -1,9 +1,14 @@
 name: Deploy tibi-docs
 
+# Statischer Starlight-Build, Auslieferung als Dateien über Apache.
+# Push auf master -> Build -> rsync nach htdocs/<RSYNC_PATH>/ auf ftp1.webmakers.de.
+# Auth: Repo-Token (github.token) + Basispanel-Subdomain docs.tibicms.de (ID 2216,
+# gitbaseRepository=cms/tibi-docs). Der rsync-User landet in htdocs des Kunden;
+# weiter runter kommt man nicht, deshalb ist RSYNC_PATH der Docroot-Pfad ab htdocs.
+
 on:
     push:
         branches:
-            - dev
             - master
 
 jobs:
@@ -12,78 +17,59 @@ jobs:
         runs-on: ubuntu-latest
         container:
             image: gitbase.de/actions/ubuntu:latest
-            volumes:
-                - /data:/data
         env:
             FORCE_COLOR: "true"
         steps:
-            - uses: actions/checkout@v3
+            - uses: actions/checkout@v4
               with:
                   fetch-depth: 1
                   lfs: true
                   submodules: false
 
             - name: setup-node
-              uses: actions/setup-node@v3
+              uses: actions/setup-node@v4
               with:
                   node-version: 22
+                  cache: npm
 
             - name: install-dependencies
-              run: npm install
+              run: npm ci
 
             - name: build-static
               run: npm run build
 
-            - name: build-and-push-image
-              if: github.ref == 'refs/heads/master' || github.ref == 'refs/heads/dev'
-              env:
-                  REGISTRY_PASS: ${{ secrets.REGISTRY_PASS }}
+            - name: check-static-build
               run: |
                   set -eu
-                  image="gitbase.de/${{ github.repository }}"
-
-                  if [ "${{ github.ref_name }}" = "dev" ]; then
-                      image="${image}:dev"
-                  fi
-
-                  echo "${REGISTRY_PASS}" | docker login gitbase.de -u tibibot --password-stdin
-                  docker build -t "$image" . --pull
-                  docker push "$image"
-
-            - name: deploy-staging
-              if: github.ref == 'refs/heads/dev'
-              env:
-                  COMPOSE_PROJECT_NAME: ${{ github.repository }}-${{ github.ref_name }}
-              run: |
-                  set -eu
-                  set -o allexport
-                  . ./.env
-                  set +o allexport
-
-                  COMPOSE_PROJECT_NAME=$(echo "$COMPOSE_PROJECT_NAME" | sed 's+/+-+g')
-
-                  docker compose -f docker-compose-staging.yml -p $COMPOSE_PROJECT_NAME up -d --build --remove-orphans
+                  test -f dist/index.html
+                  test -f dist/404.html
+                  test -d dist/pagefind
 
+            # .env ist gitignored -> Zielwerte stehen hier direkt (keine Secrets).
+            # RSYNC_USER = Repo + Basispanel-Subdomain-ID, RSYNC_PATH = Docroot ab htdocs.
             - name: deploy-live
-              if: github.ref == 'refs/heads/master'
               env:
-                  RSYNC_USER: ${{ github.repository }}
+                  RSYNC_USER: ${{ github.repository }},2216
                   RSYNC_PASS: ${{ github.token }}
+                  RSYNC_HOST: ftp1.webmakers.de
+                  RSYNC_PORT: "22223"
+                  RSYNC_PATH: docs.tibicms.de
               run: |
                   set -eu
-                  set -o allexport
-                  . ./.env
-                  set +o allexport
 
                   : "${RSYNC_USER:?RSYNC_USER missing}"
                   : "${RSYNC_PASS:?RSYNC_PASS missing}"
                   : "${RSYNC_HOST:?RSYNC_HOST missing}"
                   : "${RSYNC_PORT:?RSYNC_PORT missing}"
+                  : "${RSYNC_PATH:?RSYNC_PATH missing}"
 
-                  SSH_CMD="sshpass -p ${RSYNC_PASS} ssh -o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no -p ${RSYNC_PORT} -l ${RSYNC_USER}"
+                  echo "Deploying to ${RSYNC_HOST}:${RSYNC_PATH} on port ${RSYNC_PORT} as ${RSYNC_USER}"
+
+                  export SSHPASS="${RSYNC_PASS}"
+                  SSH_CMD="sshpass -e ssh -o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no -p ${RSYNC_PORT} -l ${RSYNC_USER}"
 
                   rsync -rlcgD --perms -i -u -v --stats --progress \
                       --delete \
                       -e "${SSH_CMD}" \
                       --exclude=.git \
-                      ./dist/ ${RSYNC_USER}@${RSYNC_HOST}:htdocs/
+                      ./dist/ "${RSYNC_HOST}":"./${RSYNC_PATH}/"
diff --git a/astro.config.mjs b/astro.config.mjs
index 95d048d..c4f69c9 100644
--- a/astro.config.mjs
+++ b/astro.config.mjs
@@ -4,10 +4,11 @@ import starlight from '@astrojs/starlight';
 
 // https://astro.build/config
 export default defineConfig({
-	site: 'https://tibi-docs.code.testversion.online',
+	site: 'https://docs.tibicms.de',
 	vite: {
 		server: {
 			allowedHosts: [
+				'docs.tibicms.de',
 				'tibi-docs.code.testversion.online',
 				'localhost',
 				'127.0.0.1',
diff --git a/docker-compose-staging.yml b/docker-compose-staging.yml
deleted file mode 100644
index 5c3bfbf..0000000
--- a/docker-compose-staging.yml
+++ /dev/null
@@ -1,8 +0,0 @@
-services:
-    www:
-        build: .
-        image: ${PROJECT_NAME}:dev
-        container_name: dev-${PROJECT_NAME}
-        labels:
-            traefik.enable: "true"
-            online.testversion.staging.subdomain: dev-${PROJECT_NAME}
diff --git a/plans/audit-report.json b/plans/audit-report.json
index 1b1018e..0b927aa 100644
--- a/plans/audit-report.json
+++ b/plans/audit-report.json
@@ -1,5 +1,5 @@
 {
-  "generatedAt": "2026-10-20T01:44:24.935Z",
+  "generatedAt": "2026-10-20T13:50:25.234Z",
   "stats": {
     "files": 70,
     "byDir": {