diff --git a/deploy/nomad/contract-check.nomad.hcl b/deploy/nomad/contract-check.nomad.hcl
index f6a313b..72a3cd3 100644
--- a/deploy/nomad/contract-check.nomad.hcl
+++ b/deploy/nomad/contract-check.nomad.hcl
@@ -7,9 +7,8 @@
 #
 # Env: the compose .env file (~/DealDocumentScreening/.env on the VPS) is
 # bind-mounted into every container at /secrets/.env and sourced before the
-# app starts. A sed one-liner rewrites compose hostnames (postgres, redis,
-# rabbitmq, minio) to 172.17.0.1 + published ports so the connections work
-# from outside the compose network.
+# app starts. Shell parameter substitution rewrites compose hostnames
+# (postgres, redis, rabbitmq, minio) to 172.17.0.1 + published ports.
 #
 # Image tag uses ${IMAGE_TAG}, rendered by envsubst at submit time.
 # Registry auth: host-level `docker login` on the VPS (README §5).
@@ -78,16 +77,13 @@ job "contract-check" {
       config {
         image   = "p2gnl.mu-dungeon.xyz/admin-git/contract-check-api:${IMAGE_TAG}"
         command = "sh"
-        args = [
-          "-c",
-          "set -a; . /secrets/.env; set +a; exec alembic upgrade head",
-        ]
+        args    = ["-c", "set -a; . /secrets/.env; set +a; exec alembic upgrade head"]
         mounts = [
           {
-            type   = "bind"
-            target = "/secrets/.env"
-            source = "/root/DealDocumentScreening/.env"
-            readonly = true
+            type       = "bind"
+            target     = "/secrets/.env"
+            source     = "/root/DealDocumentScreening/.env"
+            read_only  = true
           },
         ]
       }
@@ -104,25 +100,14 @@ job "contract-check" {
       config {
         image   = "p2gnl.mu-dungeon.xyz/admin-git/contract-check-api:${IMAGE_TAG}"
         command = "sh"
-        args = [
-          "-c",
-          <<-SH
-            set -a; . /secrets/.env; set +a
-            export DATABASE_URL="$${DATABASE_URL/@postgres:/@172.17.0.1:15432:}"
-            export REDIS_URL="$${REDIS_URL/@redis:/@172.17.0.1:17379:}"
-            export RABBITMQ_URL="$${RABBITMQ_URL/@rabbitmq:/@172.17.0.1:5672:}"
-            export S3_ENDPOINT_URL="http://172.17.0.1:9000"
-            export APP_VERSION="${IMAGE_TAG}"
-            exec python -m src.contract_check.api
-          SH
-        ]
-        ports = ["http"]
+        args    = ["-c", "set -a; . /secrets/.env; set +a; export DATABASE_URL=$${DATABASE_URL/@postgres:/@172.17.0.1:15432:}; export REDIS_URL=$${REDIS_URL/@redis:/@172.17.0.1:17379:}; export RABBITMQ_URL=$${RABBITMQ_URL/@rabbitmq:/@172.17.0.1:5672:}; export S3_ENDPOINT_URL=http://172.17.0.1:9000; export APP_VERSION=${IMAGE_TAG}; exec python -m src.contract_check.api"]
+        ports   = ["http"]
         mounts = [
           {
-            type     = "bind"
-            target   = "/secrets/.env"
-            source   = "/root/DealDocumentScreening/.env"
-            readonly = true
+            type       = "bind"
+            target     = "/secrets/.env"
+            source     = "/root/DealDocumentScreening/.env"
+            read_only  = true
           },
         ]
       }
@@ -159,23 +144,13 @@ job "contract-check" {
       config {
         image   = "p2gnl.mu-dungeon.xyz/admin-git/contract-check-worker-extract:${IMAGE_TAG}"
         command = "sh"
-        args = [
-          "-c",
-          <<-SH
-            set -a; . /secrets/.env; set +a
-            export DATABASE_URL="$${DATABASE_URL/@postgres:/@172.17.0.1:15432:}"
-            export RABBITMQ_URL="$${RABBITMQ_URL/@rabbitmq:/@172.17.0.1:5672:}"
-            export S3_ENDPOINT_URL="http://172.17.0.1:9000"
-            export APP_VERSION="${IMAGE_TAG}"
-            exec python -m src.contract_check.worker_extract
-          SH
-        ]
+        args    = ["-c", "set -a; . /secrets/.env; set +a; export DATABASE_URL=$${DATABASE_URL/@postgres:/@172.17.0.1:15432:}; export RABBITMQ_URL=$${RABBITMQ_URL/@rabbitmq:/@172.17.0.1:5672:}; export S3_ENDPOINT_URL=http://172.17.0.1:9000; export APP_VERSION=${IMAGE_TAG}; exec python -m src.contract_check.worker_extract"]
         mounts = [
           {
-            type     = "bind"
-            target   = "/secrets/.env"
-            source   = "/root/DealDocumentScreening/.env"
-            readonly = true
+            type       = "bind"
+            target     = "/secrets/.env"
+            source     = "/root/DealDocumentScreening/.env"
+            read_only  = true
           },
         ]
       }
@@ -210,23 +185,13 @@ job "contract-check" {
       config {
         image   = "p2gnl.mu-dungeon.xyz/admin-git/contract-check-worker-analyze:${IMAGE_TAG}"
         command = "sh"
-        args = [
-          "-c",
-          <<-SH
-            set -a; . /secrets/.env; set +a
-            export DATABASE_URL="$${DATABASE_URL/@postgres:/@172.17.0.1:15432:}"
-            export RABBITMQ_URL="$${RABBITMQ_URL/@rabbitmq:/@172.17.0.1:5672:}"
-            export S3_ENDPOINT_URL="http://172.17.0.1:9000"
-            export APP_VERSION="${IMAGE_TAG}"
-            exec python -m src.contract_check.worker_analyze
-          SH
-        ]
+        args    = ["-c", "set -a; . /secrets/.env; set +a; export DATABASE_URL=$${DATABASE_URL/@postgres:/@172.17.0.1:15432:}; export RABBITMQ_URL=$${RABBITMQ_URL/@rabbitmq:/@172.17.0.1:5672:}; export S3_ENDPOINT_URL=http://172.17.0.1:9000; export APP_VERSION=${IMAGE_TAG}; exec python -m src.contract_check.worker_analyze"]
         mounts = [
           {
-            type     = "bind"
-            target   = "/secrets/.env"
-            source   = "/root/DealDocumentScreening/.env"
-            readonly = true
+            type       = "bind"
+            target     = "/secrets/.env"
+            source     = "/root/DealDocumentScreening/.env"
+            read_only  = true
           },
         ]
       }
@@ -261,23 +226,13 @@ job "contract-check" {
       config {
         image   = "p2gnl.mu-dungeon.xyz/admin-git/contract-check-worker-prescreen:${IMAGE_TAG}"
         command = "sh"
-        args = [
-          "-c",
-          <<-SH
-            set -a; . /secrets/.env; set +a
-            export DATABASE_URL="$${DATABASE_URL/@postgres:/@172.17.0.1:15432:}"
-            export RABBITMQ_URL="$${RABBITMQ_URL/@rabbitmq:/@172.17.0.1:5672:}"
-            export S3_ENDPOINT_URL="http://172.17.0.1:9000"
-            export APP_VERSION="${IMAGE_TAG}"
-            exec python -m src.contract_check.worker_prescreen
-          SH
-        ]
+        args    = ["-c", "set -a; . /secrets/.env; set +a; export DATABASE_URL=$${DATABASE_URL/@postgres:/@172.17.0.1:15432:}; export RABBITMQ_URL=$${RABBITMQ_URL/@rabbitmq:/@172.17.0.1:5672:}; export S3_ENDPOINT_URL=http://172.17.0.1:9000; export APP_VERSION=${IMAGE_TAG}; exec python -m src.contract_check.worker_prescreen"]
         mounts = [
           {
-            type     = "bind"
-            target   = "/secrets/.env"
-            source   = "/root/DealDocumentScreening/.env"
-            readonly = true
+            type       = "bind"
+            target     = "/secrets/.env"
+            source     = "/root/DealDocumentScreening/.env"
+            read_only  = true
           },
         ]
       }
@@ -312,21 +267,13 @@ job "contract-check" {
       config {
         image   = "p2gnl.mu-dungeon.xyz/admin-git/contract-check-worker-billing:${IMAGE_TAG}"
         command = "sh"
-        args = [
-          "-c",
-          <<-SH
-            set -a; . /secrets/.env; set +a
-            export DATABASE_URL="$${DATABASE_URL/@postgres:/@172.17.0.1:15432:}"
-            export APP_VERSION="${IMAGE_TAG}"
-            exec python -m src.contract_check.worker_billing
-          SH
-        ]
+        args    = ["-c", "set -a; . /secrets/.env; set +a; export DATABASE_URL=$${DATABASE_URL/@postgres:/@172.17.0.1:15432:}; export APP_VERSION=${IMAGE_TAG}; exec python -m src.contract_check.worker_billing"]
         mounts = [
           {
-            type     = "bind"
-            target   = "/secrets/.env"
-            source   = "/root/DealDocumentScreening/.env"
-            readonly = true
+            type       = "bind"
+            target     = "/secrets/.env"
+            source     = "/root/DealDocumentScreening/.env"
+            read_only  = true
           },
         ]
       }
@@ -361,22 +308,13 @@ job "contract-check" {
       config {
         image   = "p2gnl.mu-dungeon.xyz/admin-git/contract-check-worker-notify:${IMAGE_TAG}"
         command = "sh"
-        args = [
-          "-c",
-          <<-SH
-            set -a; . /secrets/.env; set +a
-            export DATABASE_URL="$${DATABASE_URL/@postgres:/@172.17.0.1:15432:}"
-            export RABBITMQ_URL="$${RABBITMQ_URL/@rabbitmq:/@172.17.0.1:5672:}"
-            export APP_VERSION="${IMAGE_TAG}"
-            exec python -m src.contract_check.worker_notify
-          SH
-        ]
+        args    = ["-c", "set -a; . /secrets/.env; set +a; export DATABASE_URL=$${DATABASE_URL/@postgres:/@172.17.0.1:15432:}; export RABBITMQ_URL=$${RABBITMQ_URL/@rabbitmq:/@172.17.0.1:5672:}; export APP_VERSION=${IMAGE_TAG}; exec python -m src.contract_check.worker_notify"]
         mounts = [
           {
-            type     = "bind"
-            target   = "/secrets/.env"
-            source   = "/root/DealDocumentScreening/.env"
-            readonly = true
+            type       = "bind"
+            target     = "/secrets/.env"
+            source     = "/root/DealDocumentScreening/.env"
+            read_only  = true
           },
         ]
       }