diff --git a/DEPLOY.md b/DEPLOY.md
index ed70ce8..a687951 100644
--- a/DEPLOY.md
+++ b/DEPLOY.md
@@ -40,6 +40,29 @@ Depois de novos commits:
 seconectaiescavador.update
 ```
 
+## Corrigir senha do Postgres
+
+Se o backend mostrar `FATAL: password authentication failed for user "leadscraper"`, o `.env` e o volume do Postgres ficaram com senhas diferentes. Realinhe a senha do usuario no banco usando o valor atual do `.env`:
+
+```bash
+cd /opt/Prospeccao_SeConectai
+cat .env | grep DB_PASSWORD
+docker compose -f docker-compose.prod.yml exec postgres psql -U postgres -d leadscraper
+```
+
+Dentro do `psql`, execute trocando `<senha_do_env>` pelo valor de `DB_PASSWORD`:
+
+```sql
+ALTER USER leadscraper WITH PASSWORD '<senha_do_env>';
+\q
+```
+
+Depois reinicie os servicos:
+
+```bash
+docker compose -f docker-compose.prod.yml restart backend caddy
+```
+
 ## Comandos uteis
 
 ```bash
diff --git a/docker-compose.prod.yml b/docker-compose.prod.yml
index 94c12ce..6e781cb 100644
--- a/docker-compose.prod.yml
+++ b/docker-compose.prod.yml
@@ -9,7 +9,10 @@ services:
       - caddy_data:/data
       - caddy_config:/config
     depends_on:
-      - frontend
+      backend:
+        condition: service_healthy
+      frontend:
+        condition: service_started
 
   postgres:
     image: postgres:16
@@ -53,6 +56,12 @@ services:
     depends_on:
       postgres:
         condition: service_healthy
+    healthcheck:
+      test: ["CMD-SHELL", "timeout 5 bash -c '</dev/tcp/localhost/8082'"]
+      interval: 10s
+      timeout: 5s
+      retries: 12
+      start_period: 30s
 
   frontend:
     build:
@@ -62,7 +71,8 @@ services:
         VITE_API_BASE_URL: ${API_URL:-/api}
     restart: unless-stopped
     depends_on:
-      - backend
+      backend:
+        condition: service_healthy
 
 volumes:
   postgres_data:
diff --git a/scripts/install-prod.sh b/scripts/install-prod.sh
index b41050e..5f4034f 100755
--- a/scripts/install-prod.sh
+++ b/scripts/install-prod.sh
@@ -19,10 +19,13 @@ secret() {
   openssl rand -base64 32 | tr -d '\n'
 }
 
-DB_PASSWORD="$(secret)"
-JWT_SECRET="$(secret)"
+if [[ -f "$ENV_FILE" ]]; then
+  echo "Arquivo $ENV_FILE ja existe; mantendo credenciais atuais."
+else
+  DB_PASSWORD="$(secret)"
+  JWT_SECRET="$(secret)"
 
-cat > "$ENV_FILE" <<EOF_ENV
+  cat > "$ENV_FILE" <<EOF_ENV
 DB_USER=leadscraper
 DB_PASSWORD=$DB_PASSWORD
 DB_PORT=5433
@@ -48,6 +51,7 @@ OVERPASS_ENDPOINT=https://overpass-api.de/api/interpreter
 OVERPASS_TIMEOUT_SECONDS=90
 OVERPASS_MAX_RESULTS=1000
 EOF_ENV
+fi
 
 docker compose -f "$COMPOSE_FILE" up -d --build
 
@@ -57,4 +61,4 @@ echo "URL: https://$DOMAIN"
 echo "Frontend interno: http://localhost:8081"
 echo "Backend interno: http://localhost:8082"
 echo
-echo "Segredos gerados em $ENV_FILE."
+echo "Credenciais em $ENV_FILE."