diff --git a/.gitea/workflows/deploy-nalu.yml b/.gitea/workflows/deploy-nalu.yml
index 67ab5ef..ee0c35e 100644
--- a/.gitea/workflows/deploy-nalu.yml
+++ b/.gitea/workflows/deploy-nalu.yml
@@ -211,9 +211,11 @@ jobs:
         ssh -o StrictHostKeyChecking=no ubuntu@${{ env.SWARM_MANAGER }} << SSHEOF
           set -e
 
-          # ── Scale down so secrets can be rotated ─────────────────────────
-          docker service scale nalu_app=0 2>/dev/null || true
-          sleep 5
+          # ── Remove stack so secrets can be rotated ───────────────────────
+          docker stack rm nalu 2>/dev/null || true
+          # wait until all nalu services are gone
+          timeout 60 bash -c 'until ! docker service ls 2>/dev/null | grep -q nalu_; do sleep 2; done' || true
+          sleep 3
 
           # ── Create/update Docker secrets ─────────────────────────────────
           update_secret() {