diff --git a/.gitea/workflows/deploy.yml b/.gitea/workflows/deploy.yml
index 1600a6b..6dd56f7 100644
--- a/.gitea/workflows/deploy.yml
+++ b/.gitea/workflows/deploy.yml
@@ -80,13 +80,23 @@ jobs:
       env:
         NOMAD_ADDR: "https://nomad.i80.dk:4646"
 
+    - name: Substitute secrets into Nomad job
+      run: |
+        sed \
+          -e "s|__DATABASE_URL__|${{ secrets.DATABASE_URL }}|g" \
+          -e "s|__ANTHROPIC_API_KEY__|${{ secrets.ANTHROPIC_API_KEY }}|g" \
+          -e "s|__SAXO_APP_KEY__|${{ secrets.SAXO_APP_KEY }}|g" \
+          -e "s|__SAXO_APP_SECRET_1__|${{ secrets.SAXO_APP_SECRET_1 }}|g" \
+          -e "s|__SAXO_BASE__|${{ secrets.SAXO_BASE }}|g" \
+          mmd.nomad > mmd_deploy.nomad
+
     - name: Validate Nomad job
-      run: nomad job validate mmd.nomad
+      run: nomad job validate mmd_deploy.nomad
       env:
         NOMAD_ADDR: "https://nomad.i80.dk:4646"
 
     - name: Deploy to Nomad
-      run: nomad job run mmd.nomad
+      run: nomad job run mmd_deploy.nomad
       env:
         NOMAD_ADDR: "https://nomad.i80.dk:4646"
 
diff --git a/mmd.nomad b/mmd.nomad
index a7897b2..c5be3b9 100644
--- a/mmd.nomad
+++ b/mmd.nomad
@@ -83,28 +83,17 @@ job "moneymaker" {
       }
 
       env {
-        APP_ENV         = "production"
-        PORT            = "${NOMAD_PORT_http}"
-        HOST            = "0.0.0.0"
-        LOG_DIR         = "/app/data/logs"
-        SAXO_TOKEN_FILE = "/app/data/.saxo_token.json"
-        HF_HOME         = "/app/data/hf-cache"
-      }
-
-      template {
-        data        = <<EOF
-DATABASE_URL={{ key "mmd/DATABASE_URL" }}
-ANTHROPIC_API_KEY={{ key "mmd/anthropic_api_key" }}
-SAXO_APP_KEY={{ key "mmd/SAXO_APP_KEY" }}
-SAXO_APP_SECRET_1={{ key "mmd/SAXO_APP_SECRET_1" }}
-SAXO_APP_SECRET_2={{ key "mmd/SAXO_APP_SECRET_2" }}
-SAXO_BASE={{ key "mmd/SAXO_BASE" }}
-SAXO_AUTH_URL={{ key "mmd/SAXO_AUTH_URL" }}
-SAXO_TOKEN_URL={{ key "mmd/SAXO_TOKEN_URL" }}
-SAXO_REDIRECT={{ key "mmd/SAXO_REDIRECT" }}
-EOF
-        destination = "secrets/app.env"
-        env         = true
+        APP_ENV           = "production"
+        PORT              = "${NOMAD_PORT_http}"
+        HOST              = "0.0.0.0"
+        LOG_DIR           = "/app/data/logs"
+        SAXO_TOKEN_FILE   = "/app/data/.saxo_token.json"
+        HF_HOME           = "/app/data/hf-cache"
+        DATABASE_URL      = "__DATABASE_URL__"
+        ANTHROPIC_API_KEY = "__ANTHROPIC_API_KEY__"
+        SAXO_APP_KEY      = "__SAXO_APP_KEY__"
+        SAXO_APP_SECRET_1 = "__SAXO_APP_SECRET_1__"
+        SAXO_BASE         = "__SAXO_BASE__"
       }
 
       resources {
@@ -133,25 +122,14 @@ EOF
       }
 
       env {
-        LOG_DIR         = "/app/data/logs"
-        SAXO_TOKEN_FILE = "/app/data/.saxo_token.json"
-        HF_HOME         = "/app/data/hf-cache"
-      }
-
-      template {
-        data        = <<EOF
-DATABASE_URL={{ key "mmd/DATABASE_URL" }}
-ANTHROPIC_API_KEY={{ key "mmd/anthropic_api_key" }}
-SAXO_APP_KEY={{ key "mmd/SAXO_APP_KEY" }}
-SAXO_APP_SECRET_1={{ key "mmd/SAXO_APP_SECRET_1" }}
-SAXO_APP_SECRET_2={{ key "mmd/SAXO_APP_SECRET_2" }}
-SAXO_BASE={{ key "mmd/SAXO_BASE" }}
-SAXO_AUTH_URL={{ key "mmd/SAXO_AUTH_URL" }}
-SAXO_TOKEN_URL={{ key "mmd/SAXO_TOKEN_URL" }}
-SAXO_REDIRECT={{ key "mmd/SAXO_REDIRECT" }}
-EOF
-        destination = "secrets/app.env"
-        env         = true
+        LOG_DIR           = "/app/data/logs"
+        SAXO_TOKEN_FILE   = "/app/data/.saxo_token.json"
+        HF_HOME           = "/app/data/hf-cache"
+        DATABASE_URL      = "__DATABASE_URL__"
+        ANTHROPIC_API_KEY = "__ANTHROPIC_API_KEY__"
+        SAXO_APP_KEY      = "__SAXO_APP_KEY__"
+        SAXO_APP_SECRET_1 = "__SAXO_APP_SECRET_1__"
+        SAXO_BASE         = "__SAXO_BASE__"
       }
 
       resources {