diff --git a/.gitea/workflows/deploy.yml b/.gitea/workflows/deploy.yml
index fb2463a..ea8fedd 100644
--- a/.gitea/workflows/deploy.yml
+++ b/.gitea/workflows/deploy.yml
@@ -114,6 +114,8 @@ jobs:
         version: 'latest'
 
     - name: Configure kubectl
+      env:
+        KUBECTLSECRET: ${{ secrets.KUBECTLSECRET }}
       run: |
         mkdir -p ~/.kube
 
@@ -133,11 +135,11 @@ jobs:
         fi
 
         # Try to decode as base64 first, if that fails, use as plain text
-        if echo "${{ secrets.KUBECTLSECRET }}" | base64 -d > ~/.kube/config 2>/dev/null; then
+        if echo "$KUBECTLSECRET" | base64 -d > ~/.kube/config 2>/dev/null; then
           echo "✅ KUBECTLSECRET decoded as base64"
         else
           echo "⚠️  KUBECTLSECRET is not base64, using as plain text"
-          echo "${{ secrets.KUBECTLSECRET }}" > ~/.kube/config
+          echo "$KUBECTLSECRET" > ~/.kube/config
         fi
 
         echo "📁 kubeconfig created at ~/.kube/config"
@@ -338,6 +340,8 @@ jobs:
         version: 'latest'
 
     - name: Configure kubectl
+      env:
+        KUBECTLSECRET: ${{ secrets.KUBECTLSECRET }}
       run: |
         mkdir -p ~/.kube
 
@@ -357,11 +361,11 @@ jobs:
         fi
 
         # Try to decode as base64 first, if that fails, use as plain text
-        if echo "${{ secrets.KUBECTLSECRET }}" | base64 -d > ~/.kube/config 2>/dev/null; then
+        if echo "$KUBECTLSECRET" | base64 -d > ~/.kube/config 2>/dev/null; then
           echo "✅ KUBECTLSECRET decoded as base64"
         else
           echo "⚠️  KUBECTLSECRET is not base64, using as plain text"
-          echo "${{ secrets.KUBECTLSECRET }}" > ~/.kube/config
+          echo "$KUBECTLSECRET" > ~/.kube/config
         fi
 
         echo "📁 kubeconfig created at ~/.kube/config"