diff --git a/.woodpecker/amazon.yml b/.woodpecker/amazon.yml
index 3386ac2d..816d05a0 100644
--- a/.woodpecker/amazon.yml
+++ b/.woodpecker/amazon.yml
@@ -42,13 +42,12 @@ steps:
   restore-build-cache:
     environment: &cache_environment
       AWS_DISABLESSL: "true"
-    secrets: &cache_secrets
-      - source: s3_access_key_id
-        target: AWS_ACCESS_KEY_ID
-      - source: s3_secret_key
-        target: AWS_SECRET_ACCESS_KEY
-      - source: s3_endpoint
-        target: S3_ENDPOINT
+      AWS_ACCESS_KEY_ID:
+        from_secret: s3_access_key_id
+      AWS_SECRET_ACCESS_KEY:
+        from_secret: s3_secret_key
+      S3_ENDPOINT:
+        from_secret: s3_endpoint
     image: &cache_image meltwater/drone-cache
     settings: &cache_settings
       bucket: kumomta-cache
@@ -86,7 +85,6 @@ steps:
       - evaluate: 'CI_PIPELINE_EVENT == "push" && CI_COMMIT_BRANCH == "main"'
     image: *cache_image
     environment: *cache_environment
-    secrets: *cache_secrets
     #detach: true
     settings:
       <<: *cache_settings
@@ -103,13 +101,13 @@ steps:
     pull: true
     when:
       - evaluate: '(CI_PIPELINE_EVENT == "push" && CI_COMMIT_BRANCH == "main") || CI_PIPELINE_EVENT == "tag"'
-    secrets:
-      - source: openrepo_publish_token
-        target: TOKEN
-      - source: openrepo_gpg_public
-        target: PUB
-      - source: openrepo_gpg_private
-        target: PRIV
+    environment:
+      TOKEN:
+        from_secret: openrepo_publish_token
+      PUB:
+        from_secret: openrepo_gpg_public
+      PRIV:
+        from_secret: openrepo_gpg_private
     commands:
       - "./assets/sign-rpm.sh *.rpm"
       - "./assets/upload-package.sh ${AMAZON_IMAGE} *.rpm"
diff --git a/.woodpecker/rocky.yml b/.woodpecker/rocky.yml
index 274c85a7..0739ed6c 100644
--- a/.woodpecker/rocky.yml
+++ b/.woodpecker/rocky.yml
@@ -42,13 +42,12 @@ steps:
   restore-build-cache:
     environment: &cache_environment
       AWS_DISABLESSL: "true"
-    secrets: &cache_secrets
-      - source: s3_access_key_id
-        target: AWS_ACCESS_KEY_ID
-      - source: s3_secret_key
-        target: AWS_SECRET_ACCESS_KEY
-      - source: s3_endpoint
-        target: S3_ENDPOINT
+      AWS_ACCESS_KEY_ID:
+        from_secret: s3_access_key_id
+      AWS_SECRET_ACCESS_KEY:
+        from_secret: s3_secret_key
+      S3_ENDPOINT:
+        from_secret: s3_endpoint
     image: &cache_image meltwater/drone-cache
     settings: &cache_settings
       bucket: kumomta-cache
@@ -81,7 +80,6 @@ steps:
       - evaluate: 'CI_PIPELINE_EVENT == "push" && CI_COMMIT_BRANCH == "main"'
     image: *cache_image
     environment: *cache_environment
-    secrets: *cache_secrets
     #detach: true
     settings:
       <<: *cache_settings
@@ -98,13 +96,13 @@ steps:
     pull: true
     when:
       - evaluate: '(CI_PIPELINE_EVENT == "push" && CI_COMMIT_BRANCH == "main") || CI_PIPELINE_EVENT == "tag"'
-    secrets:
-      - source: openrepo_publish_token
-        target: TOKEN
-      - source: openrepo_gpg_public
-        target: PUB
-      - source: openrepo_gpg_private
-        target: PRIV
+    environment:
+      TOKEN:
+        from_secret: openrepo_publish_token
+      PUB:
+        from_secret: openrepo_gpg_public
+      PRIV:
+        from_secret: openrepo_gpg_private
     commands:
       - "./assets/sign-rpm.sh *.rpm"
       - "./assets/upload-package.sh ${ROCKY_IMAGE} *.rpm"
diff --git a/.woodpecker/ubuntu.yml b/.woodpecker/ubuntu.yml
index 86190d75..5d9bfb4a 100644
--- a/.woodpecker/ubuntu.yml
+++ b/.woodpecker/ubuntu.yml
@@ -43,13 +43,12 @@ steps:
   restore-build-cache:
     environment: &cache_environment
       AWS_DISABLESSL: "true"
-    secrets: &cache_secrets
-      - source: s3_access_key_id
-        target: AWS_ACCESS_KEY_ID
-      - source: s3_secret_key
-        target: AWS_SECRET_ACCESS_KEY
-      - source: s3_endpoint
-        target: S3_ENDPOINT
+      AWS_ACCESS_KEY_ID:
+        from_secret: s3_access_key_id
+      AWS_SECRET_ACCESS_KEY:
+        from_secret: s3_secret_key
+      S3_ENDPOINT:
+        from_secret: s3_endpoint
     image: &cache_image meltwater/drone-cache
     settings: &cache_settings
       bucket: kumomta-cache
@@ -83,7 +82,6 @@ steps:
       - evaluate: 'CI_PIPELINE_EVENT == "push" && CI_COMMIT_BRANCH == "main"'
     image: *cache_image
     environment: *cache_environment
-    secrets: *cache_secrets
     #detach: true
     settings:
       <<: *cache_settings
@@ -102,9 +100,9 @@ steps:
     image: alpine:3.14
     when:
       - evaluate: '(CI_PIPELINE_EVENT == "push" && CI_COMMIT_BRANCH == "main") || CI_PIPELINE_EVENT == "tag"'
-    secrets:
-      - source: openrepo_publish_token
-        target: TOKEN
+    environment:
+      TOKEN:
+        from_secret: openrepo_publish_token
     commands:
       - "apk --no-cache add curl bash"
       - "./assets/upload-package.sh ${UBUNTU_IMAGE} *.deb"