diff --git a/.gitea/workflows/deploy.yml b/.gitea/workflows/deploy.yml
index 7a08ddc..4cfd98c 100644
--- a/.gitea/workflows/deploy.yml
+++ b/.gitea/workflows/deploy.yml
@@ -40,18 +40,19 @@ jobs:
 
       # tar over SSH (the runner image has no rsync). Build is unpacked into
       # a .new dir on the web host and atomically swapped in, so the live web
-      # root is never left half-written. Host, user and path are repository
-      # variables, so no infrastructure details live in the public repo.
+      # root is never left half-written. Host and path are repository secrets,
+      # not variables: run logs of a public repo are public, and Gitea prints
+      # variables in them but masks secrets.
       - name: Deploy dist/ over SSH
         env:
-          DEPLOY_HOST: ${{ vars.DEPLOY_HOST }}
+          DEPLOY_HOST: ${{ secrets.DEPLOY_HOST }}
           DEPLOY_USER: ${{ vars.DEPLOY_USER }}
-          DEPLOY_PATH: ${{ vars.DEPLOY_PATH }}
+          DEPLOY_PATH: ${{ secrets.DEPLOY_PATH }}
         run: |
           set -euo pipefail
-          : "${DEPLOY_HOST:?repository variable DEPLOY_HOST is not set}"
+          : "${DEPLOY_HOST:?repository secret DEPLOY_HOST is not set}"
           : "${DEPLOY_USER:?repository variable DEPLOY_USER is not set}"
-          : "${DEPLOY_PATH:?repository variable DEPLOY_PATH is not set}"
+          : "${DEPLOY_PATH:?repository secret DEPLOY_PATH is not set}"
           mkdir -p ~/.ssh
           echo "${{ secrets.DEPLOY_SSH_KEY }}" > ~/.ssh/deploy_key
           chmod 600 ~/.ssh/deploy_key