diff --git a/.gitea/workflows/build.yml b/.gitea/workflows/build.yml
index 697ede4..3987b0a 100644
--- a/.gitea/workflows/build.yml
+++ b/.gitea/workflows/build.yml
@@ -32,8 +32,6 @@ concurrency:
 # host, state.json or the AUR.
 env:
   AUR_MAINTAINER: ${{ vars.AUR_MAINTAINER }}
-  TARBALL_HOST: ${{ vars.TARBALL_HOST }}
-  TARBALL_PATH: ${{ vars.TARBALL_PATH }}
   TARBALL_BASE_URL: ${{ vars.TARBALL_BASE_URL }}
   WORK_DIR: /work
 
@@ -126,6 +124,10 @@ jobs:
         if: vars.PUBLISH == 'true'
         env:
           TARBALL_SSH_KEY: ${{ secrets.TARBALL_SSH_KEY }}
+          # Secrets, not variables: run logs of a public repo are public, and
+          # Gitea prints variables in them but masks secrets.
+          TARBALL_HOST: ${{ secrets.TARBALL_HOST }}
+          TARBALL_PATH: ${{ secrets.TARBALL_PATH }}
         run: |
           ASSET="$(python3 -c 'import json;print(json.load(open("release-meta.json"))["tarball"])')"
           bash scripts/publish-tarball.sh "${WORK_DIR}/out/${ASSET}"
diff --git a/README.md b/README.md
index 5f904e9..ec1363a 100644
--- a/README.md
+++ b/README.md
@@ -96,8 +96,6 @@ Set these in the Gitea repo before the first run.
 | Name | Example | Meaning |
 | --- | --- | --- |
 | `AUR_MAINTAINER` | `Asger Geel Weirsoe <asger at weircon dot dk>` | Written into the PKGBUILD header. The guidelines suggest obfuscating the address against spam harvesting. |
-| `TARBALL_HOST` | `files.example.org` | SSH host the tarballs are uploaded to |
-| `TARBALL_PATH` | `/path/to/tarballs` | Directory on that host that the web server publishes |
 | `TARBALL_BASE_URL` | `https://asger.weirsoe.dk/tarballz` | Public URL the PKGBUILD downloads from |
 | `PUBLISH` | `true` | Master switch. Unless it is `true`, a run only builds and verifies, leaving the tarball in the `jasp-build` volume under `out/`: no upload, no `state.json` commit, no AUR push. |
 
@@ -106,6 +104,8 @@ Set these in the Gitea repo before the first run.
 | Name | Meaning |
 | --- | --- |
 | `GH_TOKEN` | *Optional.* A GitHub PAT, passed to the build as `GITHUB_PAT`. Not used for publishing — several JASP R modules install from GitHub and anonymous API rate limits can fail the build. |
+| `TARBALL_HOST` | SSH host the tarballs are uploaded to. A secret rather than a variable: run logs of a public repo are public, and Gitea prints variables in them. |
+| `TARBALL_PATH` | Directory on that host that the web server publishes. A secret for the same reason. |
 | `TARBALL_SSH_KEY` | Private key authorised on `TARBALL_HOST` for uploading tarballs |
 | `AUR_SSH_PRIVATE_KEY` | Private SSH key registered with your AUR account. Copy the value already set on `agw/pi3-smart-workspace`. |
 | `STATE_PUSH_TOKEN` | Gitea token with write access to this repo, for committing `state.json`. (Gitea reserves the `GITEA_` secret prefix.) |