diff --git a/.gitea/workflows/cicd.yaml b/.gitea/workflows/cicd.yaml
index 4fdd245..0039df3 100644
--- a/.gitea/workflows/cicd.yaml
+++ b/.gitea/workflows/cicd.yaml
@@ -2,89 +2,94 @@ name: Build, Test and Deploy
 
 on:
   push:
-    branches:
-      - main
-      - int
-      - dev
+    branches: [main, int, dev]
+
+concurrency:
+  group: print-calculator-${{ gitea.ref }}
+  cancel-in-progress: true
 
 jobs:
   test-backend:
     runs-on: ubuntu-latest
     steps:
-      - name: Checkout code
-        uses: actions/checkout@v3
+      - name: Checkout
+        uses: actions/checkout@v4
 
-      - name: Set up Python
-        uses: actions/setup-python@v4
-        with:
-          python-version: '3.10'
-
-      - name: Install dependencies
+      # Evito actions/setup-python (spesso fragile su act_runner)
+      - name: Install Python deps + run tests
+        shell: bash
         run: |
-          pip install -r backend/requirements.txt
-          pip install pytest httpx
-
-      - name: Run Backend Tests
-        run: |
-          export PYTHONPATH=$PYTHONPATH:$(pwd)/backend
+          apt-get update
+          apt-get install -y --no-install-recommends python3 python3-pip
+          python3 -m pip install --upgrade pip
+          python3 -m pip install -r backend/requirements.txt
+          python3 -m pip install pytest httpx
+          export PYTHONPATH="${PYTHONPATH}:$(pwd)/backend"
           pytest backend/tests
 
   build-and-push:
     needs: test-backend
     runs-on: ubuntu-latest
     steps:
-      - name: Checkout code
-        uses: actions/checkout@v3
+      - name: Checkout
+        uses: actions/checkout@v4
 
-      - name: Set Environment Variables
+      - name: Set TAG
+        shell: bash
         run: |
           if [[ "${{ gitea.ref }}" == "refs/heads/main" ]]; then
-            echo "TAG=prod" >> $GITHUB_ENV
+            echo "TAG=prod" >> "$GITHUB_ENV"
           elif [[ "${{ gitea.ref }}" == "refs/heads/int" ]]; then
-            echo "TAG=int" >> $GITHUB_ENV
+            echo "TAG=int" >> "$GITHUB_ENV"
           else
-            echo "TAG=dev" >> $GITHUB_ENV
+            echo "TAG=dev" >> "$GITHUB_ENV"
           fi
 
+      - name: Ensure docker CLI exists
+        shell: bash
+        run: |
+          if ! command -v docker >/dev/null 2>&1; then
+            apt-get update
+            apt-get install -y --no-install-recommends docker.io
+          fi
+          docker version
+
       - name: Login to Gitea Registry
-        uses: docker/login-action@v2
-        with:
-          registry: ${{ secrets.REGISTRY_URL }}
-          username: ${{ secrets.GITEA_USER }}
-          password: ${{ secrets.GITEA_TOKEN }}
+        shell: bash
+        run: |
+          echo "${{ secrets.REGISTRY_TOKEN }}" | docker login "${{ secrets.REGISTRY_URL }}" \
+            -u "${{ secrets.REGISTRY_USER }}" --password-stdin
 
-      - name: Build and Push Backend
-        uses: docker/build-push-action@v4
-        with:
-          context: ./backend
-          push: true
-          tags: ${{ secrets.REGISTRY_URL }}/${{ gitea.repository_owner }}/print-calculator-backend:${{ env.TAG }}
+      - name: Build & Push Backend
+        shell: bash
+        run: |
+          BACKEND_IMAGE="${{ secrets.REGISTRY_URL }}/${{ gitea.repository_owner }}/print-calculator-backend:${{ env.TAG }}"
+          docker build -t "$BACKEND_IMAGE" ./backend
+          docker push "$BACKEND_IMAGE"
 
-      - name: Build and Push Frontend
-        uses: docker/build-push-action@v4
-        with:
-          context: ./frontend
-          push: true
-          tags: ${{ secrets.REGISTRY_URL }}/${{ gitea.repository_owner }}/print-calculator-frontend:${{ env.TAG }}
+      - name: Build & Push Frontend
+        shell: bash
+        run: |
+          FRONTEND_IMAGE="${{ secrets.REGISTRY_URL }}/${{ gitea.repository_owner }}/print-calculator-frontend:${{ env.TAG }}"
+          docker build -t "$FRONTEND_IMAGE" ./frontend
+          docker push "$FRONTEND_IMAGE"
 
   deploy:
     needs: build-and-push
     runs-on: ubuntu-latest
     steps:
-      - name: Checkout code
-        uses: actions/checkout@v3
+      - name: Checkout (serve per avere compose + env nel workspace)
+        uses: actions/checkout@v4
 
-      - name: Set Deployment Vars
+      - name: Set ENV
+        shell: bash
         run: |
           if [[ "${{ gitea.ref }}" == "refs/heads/main" ]]; then
-            echo "ENV=prod" >> $GITHUB_ENV
-            echo "TAG=prod" >> $GITHUB_ENV
+            echo "ENV=prod" >> "$GITHUB_ENV"
           elif [[ "${{ gitea.ref }}" == "refs/heads/int" ]]; then
-            echo "ENV=int" >> $GITHUB_ENV
-            echo "TAG=int" >> $GITHUB_ENV
+            echo "ENV=int" >> "$GITHUB_ENV"
           else
-            echo "ENV=dev" >> $GITHUB_ENV
-            echo "TAG=dev" >> $GITHUB_ENV
+            echo "ENV=dev" >> "$GITHUB_ENV"
           fi
 
       - name: Create Remote Directory
@@ -111,7 +116,7 @@ jobs:
           username: ${{ secrets.SERVER_USER }}
           key: ${{ secrets.SSH_PRIVATE_KEY }}
           source: "deploy/envs/${{ env.ENV }}.env"
-          target: "/mnt/user/appdata/print-calculator/${{ env.ENV }}/.env"
+          target: "/mnt/user/appdata/print-calculator/${{ env.ENV }}/"
 
       - name: Execute Remote Deployment
         uses: appleboy/ssh-action@v0.1.10
@@ -120,18 +125,14 @@ jobs:
           username: ${{ secrets.SERVER_USER }}
           key: ${{ secrets.SSH_PRIVATE_KEY }}
           script: |
+            set -e
             cd /mnt/user/appdata/print-calculator/${{ env.ENV }}/
-            
-            # Rename the copied env file to strictly '.env' so docker compose picks it up automatically
-            mv ${{ env.ENV }}.env .env
-            
-            # Login to registry
-            echo ${{ secrets.GITEA_TOKEN }} | docker login ${{ secrets.REGISTRY_URL }} -u ${{ secrets.GITEA_USER }} --password-stdin
-            
-            # Pull new images
-            # We force reading from .env just to be safe, though default behavior does it too.
+
+            # il file copiato si chiama "dev.env"/"int.env"/"prod.env"
+            mv "${{ env.ENV }}.env" .env
+
+            echo "${{ secrets.REGISTRY_TOKEN }}" | docker login "${{ secrets.REGISTRY_URL }}" \
+              -u "${{ secrets.REGISTRY_USER }}" --password-stdin
+
             docker compose --env-file .env -f docker-compose.deploy.yml pull
-            
-            # Start/Update services
-            # TAG is inside .env now, so we don't even need to pass it explicitly!
             docker compose --env-file .env -f docker-compose.deploy.yml up -d --remove-orphans