diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml
index e3f8a58..7723fe4 100644
--- a/.github/workflows/deploy.yml
+++ b/.github/workflows/deploy.yml
@@ -193,11 +193,8 @@ jobs:
             ${{ secrets.SSH_USER }}@${{ secrets.SSH_HOST }}:/usr/local/bastille/jails/web/root/usr/local/www/blog/fonts/
 
       - name: Trigger syndication webhook
-        env:
-          SECRET: ${{ secrets.SECRET }}
-          SITE_URL: ${{ secrets.SITE_URL }}
         run: |
-          # bastille cmd does not forward env vars — use jexec with explicit env.
+          # Script reads SECRET+SITE_URL from /usr/local/indiekit/.env directly — no env passing needed.
           ssh -p 222 -i ~/.ssh/id_rsa -o StrictHostKeyChecking=no \
             ${{ secrets.SSH_USER }}@${{ secrets.SSH_HOST }} \
-            "doas jexec node env SECRET='$SECRET' SITE_URL='$SITE_URL' sh /usr/local/indiekit/syndicate-webhook.sh"
+            "doas bastille cmd node sh /usr/local/indiekit/syndicate-webhook.sh"