diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml
index e917049..b2aad31 100644
--- a/.github/workflows/deploy.yml
+++ b/.github/workflows/deploy.yml
@@ -47,8 +47,25 @@ jobs:
         env:
           HF_TOKEN: ${{ secrets.HF_TOKEN }}
         run: |
+          set -euo pipefail
+
+          # Diagnostic
+          echo "::group::Environment check"
+          if [ -z "${HF_TOKEN:-}" ]; then
+            echo "ERROR: HF_TOKEN secret is not set."
+            echo "Add it at: https://github.com/ATLAS-PJK-GM007/ZeaVis-Edu/settings/secrets/actions"
+            echo "Name: HF_TOKEN  Value: your Hugging Face token"
+            exit 1
+          fi
+          echo "HF_TOKEN is set (length: ${#HF_TOKEN})"
+          echo "::endgroup::"
+
+          echo "::group::Install dependencies"
           python -m pip install --upgrade pip
           python -m pip install 'tensorflow>=2.13.0' 'tf2onnx>=1.16.1' 'onnx>=1.16.0' 'huggingface_hub'
+          echo "::endgroup::"
+
+          echo "::group::Download model from Hugging Face"
           python -c "
           from huggingface_hub import hf_hub_download
           import os
@@ -56,13 +73,21 @@ jobs:
           path = hf_hub_download(
               repo_id='MythEclipse2737/corn-leaf-disease-classifier',
               filename='best_model.keras',
-              token=os.environ.get('HF_TOKEN'),
+              token=os.environ['HF_TOKEN'],
               local_dir='best_model',
           )
           print(f'Model downloaded to {path}')
           "
+          echo "::endgroup::"
+
+          echo "::group::Export SavedModel + TFLite"
+          export PROTOCOL_BUFFERS_PYTHON_IMPLEMENTATION=python
           python save_model.py
+          echo "::endgroup::"
+
+          echo "::group::Export ONNX"
           python convert_onnx.py
+          echo "::endgroup::"
 
       - name: Log in to GHCR
         uses: docker/login-action@v3