diff --git a/.github/workflows/sync-beta.yml b/.github/workflows/sync-beta.yml
index 3d66fc9..c9b2920 100644
--- a/.github/workflows/sync-beta.yml
+++ b/.github/workflows/sync-beta.yml
@@ -1,7 +1,4 @@
 name: Sync beta ← master
-# After deploy succeeds on master, merge master back into beta so both branches
-# stay aligned. Uses GITHUB_TOKEN (default) for the push — this intentionally
-# does NOT trigger auto-pr.yml (GitHub skips workflows triggered by GITHUB_TOKEN).
 
 on:
   workflow_run:
@@ -26,22 +23,29 @@ jobs:
         with:
           fetch-depth: 0
 
-      - name: Configure Git identity
+      - name: Configure Git
         run: |
           git config user.name "github-actions"
           git config user.email "actions@github.com"
 
-      - name: Show commits that will be lost on beta
+      - name: Fetch branches
         run: |
-          echo "=== Commits on beta NOT on master (will be overwritten) ==="
-          git log origin/master..origin/beta --oneline || echo "(none — beta is already up to date with master)"
-          echo "============================================================"
+          git fetch origin master
+          git fetch origin beta
 
-      - name: Sync master → beta (force reset)
+      - name: Show overwritten commits
         run: |
-          git fetch origin
-          git checkout beta
-          git reset --hard origin/master
+          echo "=== Overwritten commits ==="
+          git log origin/master..origin/beta --oneline || echo "(none)"
+          echo "==========================="
+
+      - name: Sync beta to master
+        run: |
+          git checkout -B beta origin/master
           git push origin beta --force
-          echo "✓ beta now matches master exactly"
-          git log --oneline -3
\ No newline at end of file
+          echo "✓ beta synced"
+
+      - name: Verify
+        run: |
+          git fetch origin
+          git log origin/beta -3 --oneline
\ No newline at end of file
diff --git a/apps/api/scripts/deploy-bluegreen.sh b/apps/api/scripts/deploy-bluegreen.sh
index 4f7f5ab..91c1efd 100644
--- a/apps/api/scripts/deploy-bluegreen.sh
+++ b/apps/api/scripts/deploy-bluegreen.sh
@@ -469,7 +469,6 @@ if [ "$_RUNNING_IMAGE" = "$IMAGE" ]; then
         _ft_log "msg='SHA differs from running image -- proceeding' running=${_RUNNING_IMAGE:-none} target=$IMAGE"
     fi
     unset _RUNNING_IMAGE
-fi
 
 # ---------------------------------------------------------------------------
 # [3/7] START INACTIVE CONTAINER
diff --git a/apps/api/scripts/validate-env.sh b/apps/api/scripts/validate-env.sh
index d15084f..d9f17c4 100644
--- a/apps/api/scripts/validate-env.sh
+++ b/apps/api/scripts/validate-env.sh
@@ -119,7 +119,6 @@ REQUIRED_API_VARS=(
     API_BASE_URL
     CORS_ORIGIN
     SUPABASE_URL
-    SUPABASE_JWT_SECRET
     REDIS_URL
     METRICS_SCRAPE_TOKEN
 )