diff --git a/.gitea/workflows/deploy.yaml b/.gitea/workflows/deploy.yaml
index e23ac99..934a5df 100644
--- a/.gitea/workflows/deploy.yaml
+++ b/.gitea/workflows/deploy.yaml
@@ -47,19 +47,25 @@ jobs:
           GITEA_RUNNER_REGISTRATION_TOKEN: ${{ secrets._GITEA_RUNNER_REGISTRATION_TOKEN }}
           VAULTWARDEN_ADMIN_TOKEN: ${{ secrets.VAULTWARDEN_ADMIN_TOKEN }}
         run: |
-          sshpass -e ssh -p 22 "$SSH_USERNAME@$SSH_HOST" env \
-            DEPLOY_DIRECTORY="$DEPLOY_DIRECTORY" \
-            BESZEL_AGENT_KEY="$BESZEL_AGENT_KEY" \
-            BESZEL_AGENT_TOKEN="$BESZEL_AGENT_TOKEN" \
-            GITEA_RUNNER_REGISTRATION_TOKEN="$GITEA_RUNNER_REGISTRATION_TOKEN" \
-            VAULTWARDEN_ADMIN_TOKEN="$VAULTWARDEN_ADMIN_TOKEN" \
-            bash -s << 'EOT'
+          sshpass -e ssh -p 22 "$SSH_USERNAME@$SSH_HOST" bash -s << EOT
             set -e
             cd "$DEPLOY_DIRECTORY"
-            
             mkdir -p secrets
-            echo "$BESZEL_AGENT_KEY" > secrets/beszel_agent_key.txt
-            echo "$BESZEL_AGENT_TOKEN" > secrets/beszel_agent_token.txt
-            echo "$GITEA_RUNNER_REGISTRATION_TOKEN" > secrets/gitea_runner_registration_token.txt
-            echo "$VAULTWARDEN_ADMIN_TOKEN" > secrets/vaultwarden_admin_token.txt
+
+            cat << 'EOF_SECRET' > secrets/beszel_agent_key.txt
+          $BESZEL_AGENT_KEY
+          EOF_SECRET
+
+            cat << 'EOF_SECRET' > secrets/beszel_agent_token.txt
+          $BESZEL_AGENT_TOKEN
+          EOF_SECRET
+
+            cat << 'EOF_SECRET' > secrets/gitea_runner_registration_token.txt
+          $GITEA_RUNNER_REGISTRATION_TOKEN
+          EOF_SECRET
+
+            cat << 'EOF_SECRET' > secrets/vaultwarden_admin_token.txt
+          $VAULTWARDEN_ADMIN_TOKEN
+          EOF_SECRET
           EOT
+