diff --git a/AGENTS.md b/AGENTS.md
index 63af66b..d62c91f 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -30,6 +30,14 @@ If a broader behavioral change is made, add or run the smallest practical extra
 
 ## Git Workflow
 
+Project remote:
+
+```text
+https://git.ma-al.com/rajch_ales/MaalFlows.git
+```
+
+The main branch is `main`.
+
 After each completed project code change:
 
 1. Review `git diff`.
@@ -40,14 +48,43 @@ After each completed project code change:
 
 Do not stage unrelated untracked files such as historical audits, screenshots, exports, or mail-filter documentation unless the user explicitly asks for them.
 
+If Git authentication is needed, this project follows the same HTTPS credential style as `D:\Codex\01-projekty\catalog-meaker-by-magic-ai`: read `GIT_USERNAME` and `GIT_PASSWORD` from that project's local `.env` only for the command that needs them. Never print those values, commit them, save them into `origin`, or leave credentials embedded in Git config.
+
 ## Production Update
 
-After a successful push, update the production server only when the deployment target and restart command are known for this project.
+After a successful push, update the production server.
 
-Expected deployment shape:
+Production details:
 
-```powershell
-ssh <production-host> "cd <app-directory> && git pull --ff-only && npm install --omit=dev && <restart-command>"
+```text
+Host: app.black-week.cz
+SSH user: root
+SSH key: C:/Users/DELL/.ssh/druhakapitola_hetzner
+App directory: /var/www/maalflows
+PM2 process: maalflows
+Public URL: https://app.black-week.cz/admin
 ```
 
-Before running production deploy commands, confirm the real host, app directory, and restart command if they are not already documented in the repository or current task context.
+Deploy workflow:
+
+1. SSH to `root@app.black-week.cz` with the `druhakapitola_hetzner` key.
+2. In `/var/www/maalflows`, check `git status --short` first. Stop if there are unexpected local changes.
+3. Ensure server `origin` is `https://git.ma-al.com/rajch_ales/MaalFlows.git`.
+4. Fetch `origin main`. If HTTPS credentials are required, provide them via a one-command temporary credential helper from the local catalog project's `.env`; do not store credentials on the server.
+5. Run `git merge --ff-only FETCH_HEAD`.
+6. Run `npm install --omit=dev`.
+7. Run `npm run check`.
+8. Run `pm2 restart maalflows`.
+9. Run `pm2 save`.
+10. Verify:
+
+```bash
+cd /var/www/maalflows && git status --short
+cd /var/www/maalflows && git log -1 --oneline
+pm2 describe maalflows
+curl -s -o /dev/null -w '%{http_code} %{content_type}\n' http://127.0.0.1:3400/admin
+curl -s -o /dev/null -w '%{http_code} %{content_type}\n' http://127.0.0.1:3400/widget.js
+curl -k -s -o /dev/null -w '%{http_code} %{content_type}\n' https://app.black-week.cz/admin
+```
+
+Expected verification: PM2 status `online`, local `/admin` and `/widget.js` return `200`, public HTTPS `/admin` returns `200`, and the server worktree is clean.