diff --git a/tenants/piloto/30-apps-stubs.yaml b/tenants/piloto/30-apps-stubs.yaml
index c5af430..0496ed5 100644
--- a/tenants/piloto/30-apps-stubs.yaml
+++ b/tenants/piloto/30-apps-stubs.yaml
@@ -34,95 +34,6 @@ spec:
   selector: { app: backend }
   ports: [{ name: http, port: 80, targetPort: 8083 }]
 ---
-apiVersion: apps/v1
-kind: Deployment
-metadata: { name: bff, namespace: piloto-prod }
-spec:
-  replicas: 1
-  selector: { matchLabels: { app: bff } }
-  template:
-    metadata: { labels: { app: bff } }
-    spec:
-      containers:
-        - name: whoami
-          image: traefik/whoami:latest
-          args: ["--name", "athletic-map-bff (stub)"]
-          ports: [{ containerPort: 80 }]
----
-apiVersion: v1
-kind: Service
-metadata: { name: bff, namespace: piloto-prod }
-spec:
-  selector: { app: bff }
-  ports: [{ port: 80, targetPort: 80 }]
----
-apiVersion: v1
-kind: ConfigMap
-metadata: { name: frontend-index, namespace: piloto-prod }
-data:
-  index.html: |
-    <!doctype html>
-    <html lang="pt-br"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width, initial-scale=1">
-    <title>Athletic Map — Piloto</title>
-    <script src="https://auth-piloto.athleticmap.influxdigital.com.br/js/keycloak.js"></script>
-    <style>
-    body{font-family:system-ui,sans-serif;background:#0a2547;color:#eaf2ff;margin:0;padding:2rem}
-    .card{max-width:760px;margin:2rem auto;background:#0e2f57;border-top:4px solid #37ca37;border-radius:12px;padding:2rem;box-shadow:0 12px 40px rgba(0,0,0,.4)}
-    h1{color:#37ca37;margin:0 0 .3rem}.muted{color:#8fb0d9}b{color:#fff}
-    pre{background:#06182e;padding:1rem;border-radius:8px;overflow:auto;color:#9fe8aa;font-size:.85rem}
-    button{background:#188bf6;color:#fff;border:0;border-radius:8px;padding:.6rem 1.2rem;cursor:pointer;font-weight:700}
-    .tag{display:inline-block;background:#155eef;border-radius:20px;padding:.15rem .7rem;margin:.15rem;font-size:.8rem}
-    </style></head>
-    <body><div class="card" id="app"><p class="muted">Carregando…</p></div>
-    <script>
-    const kc = new Keycloak({ url: 'https://auth-piloto.athleticmap.influxdigital.com.br', realm: 'athleticmap', clientId: 'spa' });
-    kc.init({ onLoad: 'login-required', pkceMethod: 'S256', checkLoginIframe: false }).then(function (auth) {
-      if (!auth) { document.getElementById('app').innerHTML = '<p>Nao autenticado.</p>'; return; }
-      var t = kc.tokenParsed;
-      var roles = ((t.realm_access && t.realm_access.roles) || []).map(function (r) { return '<span class="tag">' + r + '</span>'; }).join('');
-      document.getElementById('app').innerHTML =
-        '<h1>Athletic Map</h1>' +
-        '<p class="muted">tenant <b>piloto</b> · login OIDC (Authorization Code + PKCE)</p>' +
-        '<p>Bem-vindo, <b>' + t.preferred_username + '</b></p>' +
-        '<p>Roles no token: ' + roles + '</p>' +
-        '<h3>Backend <code>/api/me</code> (JWT validado no servidor):</h3>' +
-        '<pre id="me">chamando…</pre>' +
-        '<button onclick="kc.logout()">Sair</button>';
-      fetch('/api/me', { headers: { Authorization: 'Bearer ' + kc.token } })
-        .then(function (r) { return r.json(); })
-        .then(function (me) { document.getElementById('me').textContent = JSON.stringify(me, null, 2); })
-        .catch(function (e) { document.getElementById('me').textContent = 'erro: ' + e; });
-    }).catch(function (e) { document.getElementById('app').innerHTML = '<p>Erro ao iniciar Keycloak: ' + e + '</p>'; });
-    </script></body></html>
----
-apiVersion: apps/v1
-kind: Deployment
-metadata: { name: frontend, namespace: piloto-prod }
-spec:
-  replicas: 1
-  selector: { matchLabels: { app: frontend } }
-  template:
-    metadata:
-      labels: { app: frontend }
-      annotations: { configVersion: "spa-2" }
-    spec:
-      containers:
-        - name: nginx
-          image: nginx:alpine
-          ports: [{ containerPort: 80 }]
-          volumeMounts:
-            - { name: html, mountPath: /usr/share/nginx/html }
-      volumes:
-        - name: html
-          configMap: { name: frontend-index }
----
-apiVersion: v1
-kind: Service
-metadata: { name: frontend, namespace: piloto-prod }
-spec:
-  selector: { app: frontend }
-  ports: [{ port: 80, targetPort: 80 }]
----
 apiVersion: networking.k8s.io/v1
 kind: Ingress
 metadata:
diff --git a/tenants/piloto/95-frontend-spa.yaml b/tenants/piloto/95-frontend-spa.yaml
index 00ff0a5..8f8dc96 100644
--- a/tenants/piloto/95-frontend-spa.yaml
+++ b/tenants/piloto/95-frontend-spa.yaml
@@ -20,9 +20,14 @@ spec:
     spec:
       containers:
         - name: frontend-spa
-          image: docker.io/library/frontend-spa:1.0
+          image: docker.io/library/frontend-spa:1.1
           imagePullPolicy: Never
           ports: [{ containerPort: 80 }]
+          env:
+            - { name: ATM_KC_URL, value: "https://auth-piloto.athleticmap.influxdigital.com.br" }
+            - { name: ATM_REALM, value: "athleticmap" }
+            - { name: ATM_CLIENT, value: "spa" }
+            - { name: ATM_TENANT, value: "piloto" }
           resources:
             requests: { cpu: 50m, memory: 64Mi }
             limits: { cpu: 200m, memory: 128Mi }
