diff --git a/deploy/stack-deploy.sh b/deploy/stack-deploy.sh
index 0326df3..4eea86d 100755
--- a/deploy/stack-deploy.sh
+++ b/deploy/stack-deploy.sh
@@ -12,6 +12,10 @@
 #       ├── hwaccel.ml.yml
 #       └── immich.env              ← optional, same as flat pattern
 #
+# Env layering:
+#   deploy/global.env   ← always loaded first (DOMAIN, DOMAIN_NAME, ALT_DOMAIN, etc.)
+#   <stack>.env         ← loaded second; stack values override globals
+#
 # Merge strategy: docker compose ... config | docker stack deploy -c -
 # All files in the folder matching *.yml or *.yaml are included.
 # Main file (<stack>.yml or <stack>.yaml) is always passed FIRST.
@@ -22,6 +26,7 @@ set -euo pipefail
 STACK="${1:?Usage: stack-deploy.sh <stack-name>}"
 DIR="/volume1/docker/compose-files"
 PY="$DIR/deploy/envparse.py"
+GLOBAL_ENV="$DIR/deploy/global.env"
 
 # ── Locate compose file(s) ──────────────────────────────────────────────────
 
@@ -75,34 +80,55 @@ for f in "${EXTRAS[@]:-}"; do
   [ -n "$f" ] && F_FLAGS+=(-f "$f")
 done
 
-# ── Load env file if present ─────────────────────────────────────────────────
+# ── Load env (global base + optional stack override) ─────────────────────────
 
 HINT="  Hint: 'secret not found' means Woodpecker hasn't provisioned secrets yet.\n  Trigger the pipeline: https://woodpecker.bryanmail.net\n"
 
-if [ -f "$ENVFILE" ]; then
-  echo "    Env:     $ENVFILE"
+GLOBAL_EXISTS=0
+STACK_EXISTS=0
+[ -f "$GLOBAL_ENV" ] && GLOBAL_EXISTS=1
+[ -f "$ENVFILE"    ] && STACK_EXISTS=1
+
+if [ "$GLOBAL_EXISTS" -eq 1 ] && [ "$STACK_EXISTS" -eq 1 ]; then
+  echo "    Env:     $GLOBAL_ENV + $ENVFILE (stack overrides global)"
+  eval "$(python3 "$PY" export_merged "$GLOBAL_ENV" "$ENVFILE")"
+  VARS="$(python3 "$PY" vars_merged "$GLOBAL_ENV" "$ENVFILE")"
+
+elif [ "$GLOBAL_EXISTS" -eq 1 ]; then
+  echo "    Env:     $GLOBAL_ENV (no stack env)"
+  eval "$(python3 "$PY" export "$GLOBAL_ENV")"
+  VARS="$(python3 "$PY" vars "$GLOBAL_ENV")"
+
+elif [ "$STACK_EXISTS" -eq 1 ]; then
+  echo "    Env:     $ENVFILE (no global env)"
   eval "$(python3 "$PY" export "$ENVFILE")"
   VARS="$(python3 "$PY" vars "$ENVFILE")"
-  echo "    Vars:    $VARS"
 
+else
+  echo "    Env:     (none)"
+  VARS=""
+fi
+
+echo "    Vars:    $VARS"
+
+# ── Deploy ───────────────────────────────────────────────────────────────────
+
+if [ -n "$VARS" ]; then
   if [ "${#F_FLAGS[@]}" -gt 2 ]; then
-    # Folder mode with extras: use docker compose config to merge, then deploy
+    # Folder mode with extras: merge via docker compose config
     docker compose "${F_FLAGS[@]}" config \
       | python3 "$PY" strip \
       | envsubst "$VARS" \
       | docker stack deploy -c - "$STACK" \
       || { printf "\n%b" "$HINT"; exit 1; }
   else
-    # Single file: envsubst directly (preserves existing behavior exactly)
+    # Single file
     envsubst "$VARS" < "$MAIN" \
       | python3 "$PY" strip \
       | docker stack deploy -c - "$STACK" \
       || { printf "\n%b" "$HINT"; exit 1; }
   fi
-
 else
-  echo "    Env:     (none)"
-
   if [ "${#F_FLAGS[@]}" -gt 2 ]; then
     docker compose "${F_FLAGS[@]}" config \
       | python3 "$PY" strip \