diff --git a/.env.example b/.env.example
index 7e44980..2c981bb 100644
--- a/.env.example
+++ b/.env.example
@@ -60,6 +60,8 @@ ONE_IND_RESUMO=0
 # ---- Certificado A1 (o .pfx precisa ir para a máquina nova — ver runbook) ----
 CERT_HOST_DIR=/data/rastro/certificado
 DFE_CERT_PFX_CONTAINER_PATH=/certs/11de260603452f3c.pfx
+# Sem acesso ao disco do servidor: o .pfx em base64 (base64 -i xxx.pfx | tr -d '\n')
+DFE_CERT_PFX_BASE64=
 DFE_CERT_PASSPHRASE=                       # copie do .env antigo
 DFE_TLS_REJECT_UNAUTHORIZED=false
 
diff --git a/docker-compose.yaml b/docker-compose.yaml
index 8ba2e20..e24cdd7 100644
--- a/docker-compose.yaml
+++ b/docker-compose.yaml
@@ -10,8 +10,8 @@
 #   • Teradata SEFAZ (processor, backend, analytics): nós COP por IP — o DNS da UTIC não
 #     resolve trdtdbcopN. TERADATA_ENABLED/USER/PASSWORD e EVIDENCE_KEYS em Environment
 #     Variables do Coolify. EVIDENCE_KEYS: "1:<openssl rand -base64 32>" (guarde cópia!).
-#   • Este servidor não monta o certificado A1: XML sob demanda da SEFAZ fica desligado
-#     aqui (o visualizador mostra o motivo); o restante funciona.
+#   • Certificado A1 (XML sob demanda no backend): DFE_CERT_PFX_BASE64 + DFE_CERT_PASSPHRASE
+#     como variáveis secretas no Coolify — sem montar arquivo no servidor.
 # ============================================================================
 x-app-env:
   DATABASE_URL: 'postgresql://${POSTGRES_USER}:${POSTGRES_PASSWORD}@db:5432/${POSTGRES_DB}?schema=public'
@@ -70,7 +70,7 @@ services:
       - '--chromium-disable-javascript=false'
       - '--api-timeout=60s'
   migrate:
-    image: 'gitea.externo.utic.app.br/ericoalmeida/rastro-node:v3'
+    image: 'gitea.externo.utic.app.br/ericoalmeida/rastro-node:v3.1'
     restart: 'no'
     depends_on:
       db:
@@ -84,7 +84,7 @@ services:
       DB_CONNECTION_LIMIT: '5'
     command: 'sh -c "wait-for-db && pnpm --filter @rastro/db migrate && pnpm --filter @rastro/db postgis && pnpm --filter @rastro/db timescale && pnpm --filter @rastro/db intel && pnpm --filter @rastro/db analyze && pnpm --filter @rastro/db restore-users"'
   processor:
-    image: 'gitea.externo.utic.app.br/ericoalmeida/rastro-node:v3'
+    image: 'gitea.externo.utic.app.br/ericoalmeida/rastro-node:v3.1'
     restart: unless-stopped
     depends_on:
       db:
@@ -130,7 +130,7 @@ services:
       TERADATA_USER: '${TERADATA_USER}'
       TERADATA_PASSWORD: '${TERADATA_PASSWORD}'
   backend:
-    image: 'gitea.externo.utic.app.br/ericoalmeida/rastro-node:v3'
+    image: 'gitea.externo.utic.app.br/ericoalmeida/rastro-node:v3.1'
     restart: unless-stopped
     depends_on:
       db:
@@ -161,6 +161,11 @@ services:
       TD_DOC_CACHE_HOURS: '24'
       EVIDENCE_KEYS: '${EVIDENCE_KEYS}'
       EVIDENCE_BUCKET: rastro-evidence
+      # Certificado A1 para o XML sob demanda: o .pfx em base64 numa variável secreta
+      # (base64 -i certificado.pfx | tr -d '\n'). Vazio = XML sob demanda desligado.
+      DFE_CERT_PFX_BASE64: '${DFE_CERT_PFX_BASE64}'
+      DFE_CERT_PASSPHRASE: '${DFE_CERT_PASSPHRASE}'
+      DFE_TLS_REJECT_UNAUTHORIZED: 'false'
     command: 'sh -c "wait-for-db schema && pnpm --filter @rastro/backend start"'
     expose:
       - '39010'
@@ -172,7 +177,7 @@ services:
       - traefik.http.routers.rastroapi.priority=1000
       - traefik.http.services.rastroapi.loadbalancer.server.port=39010
   web:
-    image: 'gitea.externo.utic.app.br/ericoalmeida/rastro-node:v3'
+    image: 'gitea.externo.utic.app.br/ericoalmeida/rastro-node:v3.1'
     restart: unless-stopped
     environment:
       DATABASE_URL: 'postgresql://${POSTGRES_USER}:${POSTGRES_PASSWORD}@db:5432/${POSTGRES_DB}?schema=public'
@@ -185,7 +190,7 @@ services:
     expose:
       - '39000'
   admin:
-    image: 'gitea.externo.utic.app.br/ericoalmeida/rastro-node:v3'
+    image: 'gitea.externo.utic.app.br/ericoalmeida/rastro-node:v3.1'
     restart: unless-stopped
     environment:
       DATABASE_URL: 'postgresql://${POSTGRES_USER}:${POSTGRES_PASSWORD}@db:5432/${POSTGRES_DB}?schema=public'
diff --git a/docker-compose.yml b/docker-compose.yml
index 8ba2e20..e24cdd7 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -10,8 +10,8 @@
 #   • Teradata SEFAZ (processor, backend, analytics): nós COP por IP — o DNS da UTIC não
 #     resolve trdtdbcopN. TERADATA_ENABLED/USER/PASSWORD e EVIDENCE_KEYS em Environment
 #     Variables do Coolify. EVIDENCE_KEYS: "1:<openssl rand -base64 32>" (guarde cópia!).
-#   • Este servidor não monta o certificado A1: XML sob demanda da SEFAZ fica desligado
-#     aqui (o visualizador mostra o motivo); o restante funciona.
+#   • Certificado A1 (XML sob demanda no backend): DFE_CERT_PFX_BASE64 + DFE_CERT_PASSPHRASE
+#     como variáveis secretas no Coolify — sem montar arquivo no servidor.
 # ============================================================================
 x-app-env:
   DATABASE_URL: 'postgresql://${POSTGRES_USER}:${POSTGRES_PASSWORD}@db:5432/${POSTGRES_DB}?schema=public'
@@ -70,7 +70,7 @@ services:
       - '--chromium-disable-javascript=false'
       - '--api-timeout=60s'
   migrate:
-    image: 'gitea.externo.utic.app.br/ericoalmeida/rastro-node:v3'
+    image: 'gitea.externo.utic.app.br/ericoalmeida/rastro-node:v3.1'
     restart: 'no'
     depends_on:
       db:
@@ -84,7 +84,7 @@ services:
       DB_CONNECTION_LIMIT: '5'
     command: 'sh -c "wait-for-db && pnpm --filter @rastro/db migrate && pnpm --filter @rastro/db postgis && pnpm --filter @rastro/db timescale && pnpm --filter @rastro/db intel && pnpm --filter @rastro/db analyze && pnpm --filter @rastro/db restore-users"'
   processor:
-    image: 'gitea.externo.utic.app.br/ericoalmeida/rastro-node:v3'
+    image: 'gitea.externo.utic.app.br/ericoalmeida/rastro-node:v3.1'
     restart: unless-stopped
     depends_on:
       db:
@@ -130,7 +130,7 @@ services:
       TERADATA_USER: '${TERADATA_USER}'
       TERADATA_PASSWORD: '${TERADATA_PASSWORD}'
   backend:
-    image: 'gitea.externo.utic.app.br/ericoalmeida/rastro-node:v3'
+    image: 'gitea.externo.utic.app.br/ericoalmeida/rastro-node:v3.1'
     restart: unless-stopped
     depends_on:
       db:
@@ -161,6 +161,11 @@ services:
       TD_DOC_CACHE_HOURS: '24'
       EVIDENCE_KEYS: '${EVIDENCE_KEYS}'
       EVIDENCE_BUCKET: rastro-evidence
+      # Certificado A1 para o XML sob demanda: o .pfx em base64 numa variável secreta
+      # (base64 -i certificado.pfx | tr -d '\n'). Vazio = XML sob demanda desligado.
+      DFE_CERT_PFX_BASE64: '${DFE_CERT_PFX_BASE64}'
+      DFE_CERT_PASSPHRASE: '${DFE_CERT_PASSPHRASE}'
+      DFE_TLS_REJECT_UNAUTHORIZED: 'false'
     command: 'sh -c "wait-for-db schema && pnpm --filter @rastro/backend start"'
     expose:
       - '39010'
@@ -172,7 +177,7 @@ services:
       - traefik.http.routers.rastroapi.priority=1000
       - traefik.http.services.rastroapi.loadbalancer.server.port=39010
   web:
-    image: 'gitea.externo.utic.app.br/ericoalmeida/rastro-node:v3'
+    image: 'gitea.externo.utic.app.br/ericoalmeida/rastro-node:v3.1'
     restart: unless-stopped
     environment:
       DATABASE_URL: 'postgresql://${POSTGRES_USER}:${POSTGRES_PASSWORD}@db:5432/${POSTGRES_DB}?schema=public'
@@ -185,7 +190,7 @@ services:
     expose:
       - '39000'
   admin:
-    image: 'gitea.externo.utic.app.br/ericoalmeida/rastro-node:v3'
+    image: 'gitea.externo.utic.app.br/ericoalmeida/rastro-node:v3.1'
     restart: unless-stopped
     environment:
       DATABASE_URL: 'postgresql://${POSTGRES_USER}:${POSTGRES_PASSWORD}@db:5432/${POSTGRES_DB}?schema=public'