diff --git a/.gitea/workflows/deploy-api.yaml b/.gitea/workflows/deploy-api.yaml
index 39d0f84..6dc4943 100644
--- a/.gitea/workflows/deploy-api.yaml
+++ b/.gitea/workflows/deploy-api.yaml
@@ -39,6 +39,5 @@ jobs:
       - name: Deploy container
         run: |
           export POSTGRES_PASSWORD=${{ secrets.POSTGRES_PASSWORD }}
-          export JWT_SECRET=${{ secrets.JWT_SECRET }}
           docker compose -f ./api/docker-compose.prod.yaml pull agologum-api
           docker compose -f ./api/docker-compose.prod.yaml up -d --force-recreate agologum-api
diff --git a/api/appsettings.json b/api/appsettings.json
index c34474e..12184eb 100644
--- a/api/appsettings.json
+++ b/api/appsettings.json
@@ -11,7 +11,7 @@
   "AllowedHosts": "*",
   "https_port": 443,
   "Jwt": {
-    "Key": "${JWT_SECRET}",
+    "Key": "",
     "Issuer": "agologum-api",
     "Audience": "agologum-users"
   }
diff --git a/api/docker-compose.prod.yaml b/api/docker-compose.prod.yaml
index 0a86a5f..4c96763 100644
--- a/api/docker-compose.prod.yaml
+++ b/api/docker-compose.prod.yaml
@@ -12,6 +12,8 @@ services:
       - "5000:5000"
     networks:
       - agologum-net
+    environment:
+      - Jwt__Key=${JWT_SECRET} # this seems to be the right way to pass env variables with secrets
 
 networks:
   agologum-net: