diff --git a/.github/workflows/dev-build-deplay-web.yml b/.github/workflows/dev-build-deploy-web.yml
similarity index 85%
rename from .github/workflows/dev-build-deplay-web.yml
rename to .github/workflows/dev-build-deploy-web.yml
index f25e3308..7377cf07 100644
--- a/.github/workflows/dev-build-deplay-web.yml
+++ b/.github/workflows/dev-build-deploy-web.yml
@@ -67,7 +67,15 @@ jobs:
             git checkout dev
             git reset --hard origin/dev
             git pull
-            infisical export --env=dev --format=dotenv --path="/web" --projectId=${{ secrets.INFISICAL_PROJECT_ID }} > ./secrets/.env.dev.web
+
+            sudo chmod +x ./fetch-web-secrets.sh
+            # export secrets into .env files
+            ./fetch-web-secrets.sh
+
             docker compose -f docker-compose.dev.yml pull dev-web
             docker compose -f docker-compose.dev.yml up -d --no-deps --force-recreate dev-web
-
+        env:
+          INFISICAL_CLIENT_ID: ${{ secrets.INFISICAL_CLIENT_ID }}
+          INFISICAL_CLIENT_SECRET: ${{ secrets.INFISICAL_CLIENT_SECRET }}
+          WORKSPACE_SLUG: swamphacks-core
+          ENVIRONMENT: dev
diff --git a/infra/fetch-web-secrets.sh b/infra/fetch-web-secrets.sh
new file mode 100755
index 00000000..38fe4e11
--- /dev/null
+++ b/infra/fetch-web-secrets.sh
@@ -0,0 +1,41 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+# Check required environment variables
+: "${INFISICAL_CLIENT_ID:?INFISICAL_CLIENT_ID is required}"
+: "${INFISICAL_CLIENT_SECRET:?INFISICAL_CLIENT_SECRET is required}"
+: "${WORKSPACE_SLUG:=swamphacks-core}"
+: "${ENVIRONMENT:=dev}"
+
+
+# Ensure jq is installed
+if ! command -v jq >/dev/null 2>&1; then
+  sudo apt-get update -y
+  sudo apt-get install -y jq
+fi
+
+# 1) Get access token from Infisical
+ACCESS_TOKEN=$(curl -sS --fail -X POST "https://us.infisical.com/api/v1/auth/universal-auth/login" \
+  -H "Content-Type: application/json" \
+  -d "{\"clientId\":\"${INFISICAL_CLIENT_ID}\",\"clientSecret\":\"${INFISICAL_CLIENT_SECRET}\"}" \
+  | jq -r '.accessToken // .data.accessToken')
+
+if [ -z "$ACCESS_TOKEN" ] || [ "$ACCESS_TOKEN" = "null" ]; then
+  echo "ERROR: Failed to obtain Infisical access token" >&2
+  exit 1
+fi
+
+# 2) Fetch secrets JSON and convert to dotenv
+curl -sS --fail -G "https://us.infisical.com/api/v3/secrets/raw" \
+  -H "Authorization: Bearer ${ACCESS_TOKEN}" \
+  --data-urlencode "secretPath=/web" \
+  --data-urlencode "workspaceSlug=${WORKSPACE_SLUG}" \
+  --data-urlencode "environment=${ENVIRONMENT}" \
+  --data-urlencode "viewSecretValue=true" \
+  | jq -r '.secrets[]?, .imports[].secrets[]? | "\(.secretKey)=\(.secretValue)"' \
+  > ./secrets/.env.dev.web
+
+
+# Optional: inspect
+echo "✅ .env.dev.web generated"
+