diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml
index c3a5570..0e7baab 100644
--- a/.github/workflows/deploy.yml
+++ b/.github/workflows/deploy.yml
@@ -112,8 +112,27 @@ jobs:
       env:
         KUBECONFIG_DATA: ${{ secrets.KUBECONFIG }}
       run: |
+        set -euo pipefail
+        if [ -z "${KUBECONFIG_DATA:-}" ]; then
+          echo "ERROR: secrets.KUBECONFIG is missing or empty"; exit 1
+        fi
+
         mkdir -p ~/.kube
-        echo "$KUBECONFIG_DATA" > ~/.kube/config
+
+        if DECODED="$(echo "$KUBECONFIG_DATA" | base64 -d 2>/dev/null)"; then
+          if echo "$DECODED" | grep -q '^apiVersion:'; then
+            printf '%s' "$DECODED" > ~/.kube/config
+          else
+            echo "ERROR: base64 decoded data doesn't look like kubeconfig"; exit 1
+          fi
+        else
+          if echo "$KUBECONFIG_DATA" | grep -q '^apiVersion:'; then
+            printf '%s' "$KUBECONFIG_DATA" > ~/.kube/config
+          else
+            echo "ERROR: KUBECONFIG is neither base64 nor kubeconfig YAML"; exit 1
+          fi
+        fi
+
         chmod 600 ~/.kube/config
 
     - name: Deploy to Kubernetes
@@ -157,7 +176,7 @@ jobs:
         kubectl rollout restart deployment/profile-service -n default
         kubectl rollout restart deployment/auth-service -n default
         kubectl rollout restart deployment/feed-worker -n default
-        
+
         # Wait for all deployments to be ready
         kubectl rollout status deployment/project-alpha -n default --timeout=300s
         kubectl rollout status deployment/music-service -n default --timeout=300s