diff --git a/.gitea/workflows/ci.yml b/.gitea/workflows/ci.yml
index 70157f3..04049a2 100644
--- a/.gitea/workflows/ci.yml
+++ b/.gitea/workflows/ci.yml
@@ -54,9 +54,12 @@ jobs:
             --push .
 
       - name: Trigger Coolify deploy
+        env:
+          COOLIFY_TOKEN: ${{ secrets.COOLIFY_TOKEN }}
+          COOLIFY_WEBHOOK: ${{ vars.COOLIFY_WEBHOOK }}
         run: |
-          curl -s -X GET "${{ vars.COOLIFY_WEBHOOK }}" \
-            -H "Authorization: Bearer ${{ secrets.COOLIFY_TOKEN }}"
+          curl -s -X GET "${COOLIFY_WEBHOOK}" \
+            -H "Authorization: Bearer ${COOLIFY_TOKEN}"
 
   e2e:
     if: false  # E2E tests need rewrite: auth moved from local login to OIDC (Logto). Tests still expect username/password flow.