diff --git a/.github/workflows/cancel-pulumi-lock.yml b/.github/workflows/cancel-pulumi-lock.yml
index a83d647..91389e7 100644
--- a/.github/workflows/cancel-pulumi-lock.yml
+++ b/.github/workflows/cancel-pulumi-lock.yml
@@ -58,15 +58,19 @@ jobs:
       - name: Cancel Pulumi Lock (Staging)
         if: inputs.environment == 'staging'
         working-directory: ./deploy
+        env:
+          PULUMI_STAGING_PASSPHRASE: ${{ secrets.PULUMI_STAGING_PASSPHRASE }}
         run: |
-          echo "${{ secrets.PULUMI_STAGING_PASSPHRASE }}" > passphrase.staging.txt
+          echo "$PULUMI_STAGING_PASSPHRASE" > passphrase.staging.txt
           pulumi login gs://mcp-registry-staging-pulumi-state
           PULUMI_CONFIG_PASSPHRASE_FILE=passphrase.staging.txt pulumi cancel --stack gcpStaging --yes
 
       - name: Cancel Pulumi Lock (Production)
         if: inputs.environment == 'production'
         working-directory: ./deploy
+        env:
+          PULUMI_PROD_PASSPHRASE: ${{ secrets.PULUMI_PROD_PASSPHRASE }}
         run: |
-          echo "${{ secrets.PULUMI_PROD_PASSPHRASE }}" > passphrase.prod.txt
+          echo "$PULUMI_PROD_PASSPHRASE" > passphrase.prod.txt
           pulumi login gs://mcp-registry-prod-pulumi-state
           PULUMI_CONFIG_PASSPHRASE_FILE=passphrase.prod.txt pulumi cancel --stack gcpProd --yes
\ No newline at end of file
diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml
index 0ddf00f..3811ae0 100644
--- a/.github/workflows/deploy.yml
+++ b/.github/workflows/deploy.yml
@@ -88,8 +88,10 @@ jobs:
 
       - name: Deploy to Staging
         working-directory: ./deploy
+        env:
+          PULUMI_STAGING_PASSPHRASE: ${{ secrets.PULUMI_STAGING_PASSPHRASE }}
         run: |
-          echo "${{ secrets.PULUMI_STAGING_PASSPHRASE }}" > passphrase.staging.txt
+          echo "$PULUMI_STAGING_PASSPHRASE" > passphrase.staging.txt
           make staging-up
 
   deploy-production:
@@ -127,6 +129,8 @@ jobs:
 
       - name: Deploy to Production
         working-directory: ./deploy
+        env:
+          PULUMI_PROD_PASSPHRASE: ${{ secrets.PULUMI_PROD_PASSPHRASE }}
         run: |
-          echo "${{ secrets.PULUMI_PROD_PASSPHRASE }}" > passphrase.prod.txt
+          echo "$PULUMI_PROD_PASSPHRASE" > passphrase.prod.txt
           make prod-up