diff --git a/scripts/deploy-talkpro.sh b/scripts/deploy-talkpro.sh
index dd7f825..a338306 100755
--- a/scripts/deploy-talkpro.sh
+++ b/scripts/deploy-talkpro.sh
@@ -28,7 +28,7 @@ trap cleanup EXIT
 if [[ -n "${TALKPRO_SSH_PRIVATE_KEY:-}" ]]; then
   TMP_KEY="$(mktemp)"
   chmod 600 "$TMP_KEY"
-  printf '%s\n' "$TALKPRO_SSH_PRIVATE_KEY" > "$TMP_KEY"
+  printf '%s\n' "$TALKPRO_SSH_PRIVATE_KEY" | tr -d '\r' > "$TMP_KEY"
   KEY_FILE="$TMP_KEY"
 elif [[ -z "$KEY_FILE" || ! -f "$KEY_FILE" ]]; then
   echo "ERROR: Set TALKPRO_SSH_PRIVATE_KEY (Gitea secret / env) or TALKPRO_SSH_KEY_FILE (local path)" >&2
@@ -41,7 +41,7 @@ fi
 chmod 600 "$KEY_FILE"
 
 SSH_OPTS=(-i "$KEY_FILE" -o BatchMode=yes -o StrictHostKeyChecking=accept-new)
-RSYNC_SSH="ssh -i ${KEY_FILE} -o BatchMode=yes -o StrictHostKeyChecking=accept-new"
+RSYNC_SSH="ssh -i \"$KEY_FILE\" -o BatchMode=yes -o StrictHostKeyChecking=accept-new"
 
 if [[ -f package-lock.json ]]; then
   npm ci
@@ -50,7 +50,7 @@ else
 fi
 npm run build
 
-"${SSH[@]}" "${USER}@${HOST}" "mkdir -p ${REMOTE_ROOT}"
+ssh "${SSH_OPTS[@]}" "${USER}@${HOST}" "mkdir -p ${REMOTE_ROOT}"
 
 rsync -avz --delete \
   -e "$RSYNC_SSH" \