diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml
index 92e8cd6..c594894 100644
--- a/.github/workflows/deploy.yml
+++ b/.github/workflows/deploy.yml
@@ -10,6 +10,22 @@ jobs:
     name: Deploy to VPS
     runs-on: ubuntu-latest
     steps:
+      - name: Validate required secrets
+        run: |
+          missing=()
+          [[ -z "$VPS_HOST" ]]    && missing+=(VPS_HOST)
+          [[ -z "$VPS_USER" ]]    && missing+=(VPS_USER)
+          [[ -z "$VPS_SSH_KEY" ]] && missing+=(VPS_SSH_KEY)
+          if [[ ${#missing[@]} -gt 0 ]]; then
+            echo "::error::Required secrets are not set: ${missing[*]}"
+            echo "Configure them in Settings → Secrets and variables → Actions"
+            exit 1
+          fi
+        env:
+          VPS_HOST: ${{ secrets.VPS_HOST }}
+          VPS_USER: ${{ secrets.VPS_USER }}
+          VPS_SSH_KEY: ${{ secrets.VPS_SSH_KEY }}
+
       - name: Deploy over SSH
         uses: appleboy/ssh-action@v1.2.0
         with:
@@ -21,5 +37,5 @@ jobs:
           script_stop: true
           script: |
             set -euo pipefail
-            cd ${{ secrets.VPS_APP_DIR }}
+            cd ~/apps/eventshare
             bash scripts/deploy-prod.sh