diff --git a/.github/scripts/deploy-vps-develop.sh b/.github/scripts/deploy-vps-develop.sh
index de8902501..eb72c74eb 100644
--- a/.github/scripts/deploy-vps-develop.sh
+++ b/.github/scripts/deploy-vps-develop.sh
@@ -51,14 +51,10 @@ step "Login no registro de imagens"
 printf '%s' "$GH_TOKEN" | docker login ghcr.io -u "$GH_USER" --password-stdin
 
 step "Código deste commit"
-if git remote get-url fork >/dev/null 2>&1; then
-  git remote set-url fork "https://github.com/${DONO}/DeskcommCRM.git"
-else
-  git remote add fork "https://github.com/${DONO}/DeskcommCRM.git"
-fi
-# extraHeader em vez de token na URL: a URL do remote não pode guardar segredo.
-git -c "http.extraHeader=Authorization: Bearer ${GH_TOKEN}" \
-  fetch --depth 1 fork "$SHA"
+# Repo público: fetch pela URL, sem token. Bearer no extraHeader faz o git
+# cair no prompt de usuário na VPS (exit 128, "No such device or address").
+GIT_TERMINAL_PROMPT=0 git fetch --depth 1 \
+  "https://github.com/${DONO}/DeskcommCRM.git" "$SHA"
 git reset --hard FETCH_HEAD
 
 # Relê o kit DEPOIS do reset: o _common.sh deste commit é o que vale.
diff --git a/tests/unit/deploy-vps-develop.test.ts b/tests/unit/deploy-vps-develop.test.ts
index 09226f8e7..cac0de050 100644
--- a/tests/unit/deploy-vps-develop.test.ts
+++ b/tests/unit/deploy-vps-develop.test.ts
@@ -20,4 +20,9 @@ describe("deploy da develop na VPS não puxa o registro do upstream", () => {
     expect(SCRIPT).toContain("ghcr.io/${DONO}/deskcomm-worker:develop");
     expect(SCRIPT).toContain("ghcr.io/${DONO}/deskcomm-scheduler:develop");
   });
+
+  it("puxa o código pela URL pública — Bearer no extraHeader faz o git da VPS pedir usuário", () => {
+    expect(semComentario).toContain("GIT_TERMINAL_PROMPT=0");
+    expect(semComentario).not.toMatch(/http\.extraHeader/);
+  });
 });