diff --git a/.github/workflows/backend-build.yml b/.github/workflows/backend-build.yml
index e626f430..1700e09d 100644
--- a/.github/workflows/backend-build.yml
+++ b/.github/workflows/backend-build.yml
@@ -11,10 +11,8 @@ on:
             - "backend/**/**"
 
 jobs:
-    lint:
-        name: Static Analysis (golangci-lint + gosec)
+    build:
         runs-on: ubuntu-latest
-
         steps:
             - uses: actions/checkout@v4
 
@@ -36,31 +34,12 @@ jobs:
                   working-directory: backend/gestion
                   args: --timeout=5m
 
-            - name: Install gosec
-              run: go install github.com/securego/gosec/v2/cmd/gosec@latest
-
-            - name: Run Gosec Security Scanner
+            - name: Install & run gosec
               working-directory: backend/gestion
-              run: gosec ./...
               continue-on-error: true
-
-    build:
-        name: Build
-        needs: lint
-        runs-on: ubuntu-latest
-
-        steps:
-            - uses: actions/checkout@v4
-
-            - name: Setup Go
-              uses: actions/setup-go@v5
-              with:
-                  go-version: "1.24.4"
-                  cache-dependency-path: backend/gestion/go.sum
-
-            - name: Download dependencies
-              working-directory: backend/gestion
-              run: go mod download
+              run: |
+                  go install github.com/securego/gosec/v2/cmd/gosec@latest
+                  gosec ./...
 
             - name: Build
               working-directory: backend/gestion
@@ -73,27 +52,19 @@ jobs:
                   path: backend/gestion/gestion
                   retention-days: 7
 
-    docker:
-        name: Docker Build & Push
-        needs: build
-        runs-on: ubuntu-latest
-        if: >
-            github.event_name == 'push' &&
-            (github.ref == 'refs/heads/main' || github.ref == 'refs/heads/pre-prod')
-
-        steps:
-            - uses: actions/checkout@v4
-
             - name: Login to Docker Hub
+              if: github.event_name == 'push'
               uses: docker/login-action@v3
               with:
                   username: ${{ secrets.DOCKERHUB_USERNAME }}
                   password: ${{ secrets.DOCKERHUB_TOKEN }}
 
             - name: Set up Docker Buildx
+              if: github.event_name == 'push'
               uses: docker/setup-buildx-action@v3
 
             - name: Build & push backend (runtime)
+              if: github.event_name == 'push'
               uses: docker/build-push-action@v6
               with:
                   context: .
@@ -103,6 +74,7 @@ jobs:
                   tags: xor1234/backend-mln:${{ github.ref == 'refs/heads/main' && 'latest' || 'pre-prod' }}
 
             - name: Build & push WAF
+              if: github.event_name == 'push'
               uses: docker/build-push-action@v6
               with:
                   context: .
@@ -111,13 +83,8 @@ jobs:
                   push: true
                   tags: xor1234/backend-mln:${{ github.ref == 'refs/heads/main' && 'waf' || 'waf-pre-prod' }}
 
-    deploy:
-        name: SSH Deploy
-        needs: docker
-        runs-on: ubuntu-latest
-
-        steps:
-            - name: SSH deploy
+            - name: SSH Deploy
+              if: github.event_name == 'push'
               uses: appleboy/ssh-action@v1
               with:
                   host: ${{ (github.ref == 'refs/heads/main' || github.base_ref == 'main') && secrets.SERVER_HOST_PROD || secrets.SERVER_HOST_PRE_PROD }}
diff --git a/.github/workflows/frontend-admin-build-local.yml b/.github/workflows/frontend-admin-build-local.yml
index fbb6830a..e7cc76a0 100644
--- a/.github/workflows/frontend-admin-build-local.yml
+++ b/.github/workflows/frontend-admin-build-local.yml
@@ -11,7 +11,7 @@ on:
             - "frontend-admin/**"
 
 jobs:
-    build-apk:
+    build:
         runs-on: ubuntu-latest
         steps:
             - uses: actions/checkout@v4
@@ -32,7 +32,7 @@ jobs:
             - name: Setup Android SDK
               uses: android-actions/setup-android@v3
 
-            - name: Install EAS CLI & cache deps
+            - name: Install EAS CLI & tooling
               run: |
                   npm install -g eas-cli
                   pip install -r scripts/requirements.txt --quiet
@@ -45,29 +45,31 @@ jobs:
               working-directory: frontend-admin
               run: npx tsc --noEmit
 
+            - name: Determine config
+              id: config
+              run: |
+                  if [ "${{ github.ref_name }}" = "main" ] || [ "${{ github.base_ref }}" = "main" ]; then
+                    echo "profile=production"                                >> $GITHUB_OUTPUT
+                    echo "channel=production-admin"                         >> $GITHUB_OUTPUT
+                    echo "api_url=${{ secrets.PROD_API_URL }}"              >> $GITHUB_OUTPUT
+                    echo "ota_api_url=https://mln-uber.club"                >> $GITHUB_OUTPUT
+                    echo "apk_name=admin-panel-production-$(date +%Y%m%d-%H%M).apk" >> $GITHUB_OUTPUT
+                    echo "message=Production update $(date +%Y%m%d-%H%M)"  >> $GITHUB_OUTPUT
+                  else
+                    echo "profile=pre-prod"                                 >> $GITHUB_OUTPUT
+                    echo "channel=pre-prod-admin"                           >> $GITHUB_OUTPUT
+                    echo "api_url=${{ secrets.PREPROD_API_URL }}"           >> $GITHUB_OUTPUT
+                    echo "ota_api_url=https://5.181.0.112.nip.io"           >> $GITHUB_OUTPUT
+                    echo "apk_name=admin-panel-pre-prod-$(date +%Y%m%d-%H%M).apk" >> $GITHUB_OUTPUT
+                    echo "message=Pre-prod update $(date +%Y%m%d-%H%M)"    >> $GITHUB_OUTPUT
+                  fi
+
             - name: Inject EAS project ID
               working-directory: frontend-admin
               run: |
                   jq '.expo.extra.eas.projectId = "${{ secrets.EXPO_PROJECT_ID }}"' app.json > app.tmp.json
                   mv app.tmp.json app.json
 
-            - name: Determine build profile & env
-              id: config
-              run: |
-                  if [ "${{ github.ref_name }}" = "main" ] || [ "${{ github.base_ref }}" = "main" ]; then
-                    echo "profile=production" >> $GITHUB_OUTPUT
-                    echo "channel=production-admin" >> $GITHUB_OUTPUT
-                    echo "api_url=${{ secrets.PROD_API_URL }}" >> $GITHUB_OUTPUT
-                    echo "update_url=${{ secrets.XAVIA_API_URL }}" >> $GITHUB_OUTPUT
-                    echo "apk_name=admin-panel-production-$(date +%Y%m%d-%H%M).apk" >> $GITHUB_OUTPUT
-                  else
-                    echo "profile=pre-prod" >> $GITHUB_OUTPUT
-                    echo "channel=pre-prod-admin" >> $GITHUB_OUTPUT
-                    echo "api_url=${{ secrets.PREPROD_API_URL }}" >> $GITHUB_OUTPUT
-                    echo "update_url=${{ secrets.XAVIA_API_URL }}" >> $GITHUB_OUTPUT
-                    echo "apk_name=admin-panel-pre-prod-$(date +%Y%m%d-%H%M).apk" >> $GITHUB_OUTPUT
-                  fi
-
             - name: Restore Gradle cache (RustFS)
               env:
                   AWS_ACCESS_KEY_ID: ${{ secrets.RUSTFS_ACCESS_KEY }}
@@ -81,7 +83,7 @@ jobs:
               env:
                   EXPO_TOKEN: ${{ secrets.EXPO_TOKEN }}
                   EXPO_PUBLIC_API_URL: ${{ steps.config.outputs.api_url }}
-                  EXPO_PUBLIC_UPDATE_URL: ${{ steps.config.outputs.update_url }}
+                  EXPO_PUBLIC_UPDATE_URL: ${{ secrets.XAVIA_API_URL }}
                   EAS_BUILD_NO_EXPO_GO_WARNING: true
                   NODE_OPTIONS: "--max-old-space-size=2048"
                   GRADLE_OPTS: >-
@@ -104,64 +106,25 @@ jobs:
                   S3_BUCKET: apk-builds
               run: python scripts/eas_cache.py save --app frontend-admin
 
-            - name: Rename APK
-              working-directory: frontend-admin
-              run: mv *.apk ${{ steps.config.outputs.apk_name }}
-
-            - name: Upload APK to RustFS
+            - name: Rename & upload APK to RustFS
               working-directory: frontend-admin
               env:
                   AWS_ACCESS_KEY_ID: ${{ secrets.RUSTFS_ACCESS_KEY }}
                   AWS_SECRET_ACCESS_KEY: ${{ secrets.RUSTFS_SECRET_KEY }}
                   AWS_DEFAULT_REGION: us-east-1
               run: |
+                  mv *.apk ${{ steps.config.outputs.apk_name }}
                   aws s3 cp ${{ steps.config.outputs.apk_name }} \
                     s3://apk-builds/${{ steps.config.outputs.profile }}/${{ steps.config.outputs.apk_name }} \
                     --endpoint-url https://rustfs.uber-stup.club \
                     --no-verify-ssl
 
-    ota-update:
-        needs: build-apk
-        runs-on: ubuntu-latest
-        if: github.event_name == 'push'
-        steps:
-            - uses: actions/checkout@v4
-
-            - name: Setup Node.js
-              uses: actions/setup-node@v4
-              with:
-                  node-version: 20
-                  cache: npm
-                  cache-dependency-path: frontend-admin/package-lock.json
-
-            - name: Install dependencies
-              working-directory: frontend-admin
-              run: npm ci --prefer-offline
-
-            - name: Determine channel & env
-              id: config
-              run: |
-                  if [ "${{ github.ref_name }}" = "main" ]; then
-                    echo "channel=production-admin" >> $GITHUB_OUTPUT
-                    echo "api_url=https://mln-uber.club" >> $GITHUB_OUTPUT
-                    echo "message=Production update $(date +%Y%m%d-%H%M)" >> $GITHUB_OUTPUT
-                  else
-                    echo "channel=pre-prod-admin" >> $GITHUB_OUTPUT
-                    echo "api_url=https://5.181.0.112.nip.io" >> $GITHUB_OUTPUT
-                    echo "message=Pre-prod update $(date +%Y%m%d-%H%M)" >> $GITHUB_OUTPUT
-                  fi
-
-            - name: Inject EAS project ID
-              working-directory: frontend-admin
-              run: |
-                  jq '.expo.extra.eas.projectId = "${{ secrets.EXPO_PROJECT_ID }}"' app.json > app.tmp.json
-                  mv app.tmp.json app.json
-
             - name: Publish OTA update to Xavia
+              if: github.event_name == 'push'
               working-directory: frontend-admin
               env:
                   EXPO_TOKEN: ${{ secrets.EXPO_TOKEN }}
-                  EXPO_PUBLIC_API_URL: ${{ steps.config.outputs.api_url }}
+                  EXPO_PUBLIC_API_URL: ${{ steps.config.outputs.ota_api_url }}
                   EXPO_PUBLIC_UPDATE_URL: ${{ secrets.XAVIA_API_URL }}
                   NODE_OPTIONS: "--max-old-space-size=2048"
               run: |
diff --git a/.github/workflows/frontend-client-build-local.yml b/.github/workflows/frontend-client-build-local.yml
index 171b5e39..9a4837c0 100644
--- a/.github/workflows/frontend-client-build-local.yml
+++ b/.github/workflows/frontend-client-build-local.yml
@@ -11,7 +11,7 @@ on:
             - "mobile/**"
 
 jobs:
-    build-apk:
+    build:
         runs-on: ubuntu-latest
         steps:
             - uses: actions/checkout@v4
@@ -32,7 +32,7 @@ jobs:
             - name: Setup Android SDK
               uses: android-actions/setup-android@v3
 
-            - name: Install EAS CLI & cache deps
+            - name: Install EAS CLI & tooling
               run: |
                   npm install -g eas-cli
                   pip install -r scripts/requirements.txt --quiet
@@ -45,29 +45,31 @@ jobs:
               working-directory: mobile
               run: npx tsc --noEmit
 
+            - name: Determine config
+              id: config
+              run: |
+                  if [ "${{ github.ref_name }}" = "main" ] || [ "${{ github.base_ref }}" = "main" ]; then
+                    echo "profile=production"                                >> $GITHUB_OUTPUT
+                    echo "channel=production-client"                        >> $GITHUB_OUTPUT
+                    echo "api_url=${{ secrets.PROD_API_URL }}"              >> $GITHUB_OUTPUT
+                    echo "ota_api_url=${{ secrets.PROD_API_URL }}"          >> $GITHUB_OUTPUT
+                    echo "apk_name=mobile-production-$(date +%Y%m%d-%H%M).apk" >> $GITHUB_OUTPUT
+                    echo "message=Production update $(date +%Y%m%d-%H%M)"  >> $GITHUB_OUTPUT
+                  else
+                    echo "profile=pre-prod"                                 >> $GITHUB_OUTPUT
+                    echo "channel=pre-prod-client"                          >> $GITHUB_OUTPUT
+                    echo "api_url=${{ secrets.PREPROD_API_URL }}"           >> $GITHUB_OUTPUT
+                    echo "ota_api_url=${{ secrets.PREPROD_API_URL }}"       >> $GITHUB_OUTPUT
+                    echo "apk_name=mobile-pre-prod-$(date +%Y%m%d-%H%M).apk" >> $GITHUB_OUTPUT
+                    echo "message=Pre-prod update $(date +%Y%m%d-%H%M)"    >> $GITHUB_OUTPUT
+                  fi
+
             - name: Inject EAS project ID
               working-directory: mobile
               run: |
                   jq '.expo.extra.eas.projectId = "${{ secrets.EXPO_PROJECT_ID_CLIENT }}"' app.json > app.tmp.json
                   mv app.tmp.json app.json
 
-            - name: Determine build profile & env
-              id: config
-              run: |
-                  if [ "${{ github.ref_name }}" = "main" ] || [ "${{ github.base_ref }}" = "main" ]; then
-                    echo "profile=production" >> $GITHUB_OUTPUT
-                    echo "channel=production-client" >> $GITHUB_OUTPUT
-                    echo "api_url=${{ secrets.PROD_API_URL }}" >> $GITHUB_OUTPUT
-                    echo "update_url=${{ secrets.XAVIA_API_URL }}" >> $GITHUB_OUTPUT
-                    echo "apk_name=mobile-production-$(date +%Y%m%d-%H%M).apk" >> $GITHUB_OUTPUT
-                  else
-                    echo "profile=pre-prod" >> $GITHUB_OUTPUT
-                    echo "channel=pre-prod-client" >> $GITHUB_OUTPUT
-                    echo "api_url=${{ secrets.PREPROD_API_URL }}" >> $GITHUB_OUTPUT
-                    echo "update_url=${{ secrets.XAVIA_API_URL }}" >> $GITHUB_OUTPUT
-                    echo "apk_name=mobile-pre-prod-$(date +%Y%m%d-%H%M).apk" >> $GITHUB_OUTPUT
-                  fi
-
             - name: Restore Gradle cache (RustFS)
               env:
                   AWS_ACCESS_KEY_ID: ${{ secrets.RUSTFS_ACCESS_KEY }}
@@ -81,7 +83,7 @@ jobs:
               env:
                   EXPO_TOKEN: ${{ secrets.EXPO_TOKEN }}
                   EXPO_PUBLIC_API_URL: ${{ steps.config.outputs.api_url }}
-                  EXPO_PUBLIC_UPDATE_URL: ${{ steps.config.outputs.update_url }}
+                  EXPO_PUBLIC_UPDATE_URL: ${{ secrets.XAVIA_API_URL }}
                   EAS_BUILD_NO_EXPO_GO_WARNING: true
                   NODE_OPTIONS: "--max-old-space-size=2048"
                   GRADLE_OPTS: >-
@@ -104,64 +106,25 @@ jobs:
                   S3_BUCKET: apk-builds
               run: python scripts/eas_cache.py save --app mobile
 
-            - name: Rename APK
-              working-directory: mobile
-              run: mv *.apk ${{ steps.config.outputs.apk_name }}
-
-            - name: Upload APK to RustFS
+            - name: Rename & upload APK to RustFS
               working-directory: mobile
               env:
                   AWS_ACCESS_KEY_ID: ${{ secrets.RUSTFS_ACCESS_KEY }}
                   AWS_SECRET_ACCESS_KEY: ${{ secrets.RUSTFS_SECRET_KEY }}
                   AWS_DEFAULT_REGION: us-east-1
               run: |
+                  mv *.apk ${{ steps.config.outputs.apk_name }}
                   aws s3 cp ${{ steps.config.outputs.apk_name }} \
                     s3://apk-builds/${{ steps.config.outputs.profile }}/${{ steps.config.outputs.apk_name }} \
                     --endpoint-url https://rustfs.uber-stup.club \
                     --no-verify-ssl
 
-    ota-update:
-        needs: build-apk
-        runs-on: ubuntu-latest
-        if: github.event_name == 'push'
-        steps:
-            - uses: actions/checkout@v4
-
-            - name: Setup Node.js
-              uses: actions/setup-node@v4
-              with:
-                  node-version: 20
-                  cache: npm
-                  cache-dependency-path: mobile/package-lock.json
-
-            - name: Install dependencies
-              working-directory: mobile
-              run: npm ci --prefer-offline
-
-            - name: Determine channel & env
-              id: config
-              run: |
-                  if [ "${{ github.ref_name }}" = "main" ]; then
-                    echo "channel=production-client" >> $GITHUB_OUTPUT
-                    echo "api_url=${{ secrets.PROD_API_URL }}" >> $GITHUB_OUTPUT
-                    echo "message=Production update $(date +%Y%m%d-%H%M)" >> $GITHUB_OUTPUT
-                  else
-                    echo "channel=pre-prod-client" >> $GITHUB_OUTPUT
-                    echo "api_url=${{ secrets.PREPROD_API_URL }}" >> $GITHUB_OUTPUT
-                    echo "message=Pre-prod update $(date +%Y%m%d-%H%M)" >> $GITHUB_OUTPUT
-                  fi
-
-            - name: Inject EAS project ID
-              working-directory: mobile
-              run: |
-                  jq '.expo.extra.eas.projectId = "${{ secrets.EXPO_PROJECT_ID_CLIENT }}"' app.json > app.tmp.json
-                  mv app.tmp.json app.json
-
             - name: Publish OTA update to Xavia
+              if: github.event_name == 'push'
               working-directory: mobile
               env:
                   EXPO_TOKEN: ${{ secrets.EXPO_TOKEN }}
-                  EXPO_PUBLIC_API_URL: ${{ steps.config.outputs.api_url }}
+                  EXPO_PUBLIC_API_URL: ${{ steps.config.outputs.ota_api_url }}
                   EXPO_PUBLIC_UPDATE_URL: ${{ secrets.XAVIA_API_URL }}
                   NODE_OPTIONS: "--max-old-space-size=2048"
               run: |
diff --git a/.github/workflows/frontend-web-build.yml b/.github/workflows/frontend-web-build.yml
index 1a46a0f6..dd3d96d3 100644
--- a/.github/workflows/frontend-web-build.yml
+++ b/.github/workflows/frontend-web-build.yml
@@ -13,37 +13,8 @@ on:
             - "docker-pre-prod/frontend/**"
 
 jobs:
-    lint-typecheck:
-        name: Lint & Typecheck
-        runs-on: ubuntu-latest
-
-        steps:
-            - uses: actions/checkout@v4
-
-            - name: Setup Node.js
-              uses: actions/setup-node@v4
-              with:
-                  node-version: 20
-                  cache: npm
-                  cache-dependency-path: frontend-prep/package-lock.json
-
-            - name: Install dependencies
-              working-directory: frontend-prep
-              run: npm ci
-
-            - name: Typecheck
-              working-directory: frontend-prep
-              run: npx tsc -b --noEmit
-
-            - name: Lint
-              working-directory: frontend-prep
-              run: npm run lint
-
     build:
-        name: Build
-        needs: lint-typecheck
         runs-on: ubuntu-latest
-
         steps:
             - uses: actions/checkout@v4
 
@@ -58,33 +29,31 @@ jobs:
               working-directory: frontend-prep
               run: npm ci
 
+            - name: Typecheck & lint
+              working-directory: frontend-prep
+              run: |
+                  npx tsc -b --noEmit
+                  npm run lint
+
             - name: Build
               working-directory: frontend-prep
               env:
                   VITE_TOMTOM_API_KEY: ${{ secrets.VITE_TOMTOM_API_KEY }}
               run: npm run build
 
-    docker:
-        name: Docker Build & Push
-        needs: build
-        runs-on: ubuntu-latest
-        if: >
-            (github.event_name == 'push' && (github.ref == 'refs/heads/main' || github.ref == 'refs/heads/pre-prod')) ||
-            (github.event_name == 'pull_request' && (github.base_ref == 'main' || github.base_ref == 'pre-prod'))
-
-        steps:
-            - uses: actions/checkout@v4
-
-            - name: Set up Docker Buildx
-              uses: docker/setup-buildx-action@v3
-
             - name: Login to Docker Hub
+              if: github.event_name == 'push' || github.event_name == 'pull_request'
               uses: docker/login-action@v3
               with:
                   username: ${{ secrets.DOCKERHUB_USERNAME }}
                   password: ${{ secrets.DOCKERHUB_TOKEN }}
 
+            - name: Set up Docker Buildx
+              if: github.event_name == 'push' || github.event_name == 'pull_request'
+              uses: docker/setup-buildx-action@v3
+
             - name: Build & push frontend
+              if: github.event_name == 'push' || github.event_name == 'pull_request'
               uses: docker/build-push-action@v6
               with:
                   context: .
@@ -94,14 +63,8 @@ jobs:
                   build-args: |
                       VITE_TOMTOM_API_KEY=${{ secrets.VITE_TOMTOM_API_KEY }}
 
-    deploy:
-        name: Deploy to server
-        needs: docker
-        runs-on: ubuntu-latest
-        if: github.event_name == 'push'
-
-        steps:
-            - name: SSH deploy
+            - name: SSH Deploy
+              if: github.event_name == 'push'
               uses: appleboy/ssh-action@v1
               with:
                   host: ${{ (github.ref == 'refs/heads/main' || github.base_ref == 'main') && secrets.SERVER_HOST_PROD || secrets.SERVER_HOST_PRE_PROD }}