diff --git a/.gitea/workflows/ci-cd.yaml b/.gitea/workflows/ci-cd.yaml
index f657ee8..2f050bb 100644
--- a/.gitea/workflows/ci-cd.yaml
+++ b/.gitea/workflows/ci-cd.yaml
@@ -10,8 +10,8 @@ jobs:
     runs-on: ubuntu-latest
     env:
       CARGO_TERM_COLOR: always
-      VPS_HOST: ${{ vars.VPS_HOST }}
-      VPS_USER: ${{ vars.VPS_USER }}
+      VPS_HOST: ${{ secrets.VPS_HOST }}
+      VPS_USER: ${{ secrets.VPS_USER }}
       DEPLOY_DIR: /opt/openbrain-mcp
       SERVICE_NAME: openbrain-mcp
     steps:
@@ -65,7 +65,7 @@ jobs:
         if: github.ref == 'refs/heads/main' || github.ref == 'refs/heads/master'
         run: |
           set -euxo pipefail
-          : "${VPS_HOST:?Set repository variable VPS_HOST}"
+          : "${VPS_HOST:?Set repository secret VPS_HOST}"
           : "${VPS_USER:=root}"
           install -d -m 700 "$HOME/.ssh"
           printf '%s\n' "${{ secrets.VPS_SSH_KEY }}" > "$HOME/.ssh/deploy_key"
@@ -76,7 +76,7 @@ jobs:
         if: github.ref == 'refs/heads/main' || github.ref == 'refs/heads/master'
         run: |
           set -euxo pipefail
-          : "${VPS_HOST:?Set repository variable VPS_HOST}"
+          : "${VPS_HOST:?Set repository secret VPS_HOST}"
           : "${VPS_USER:=root}"
           SSH="ssh -i $HOME/.ssh/deploy_key -o IdentitiesOnly=yes"
           SCP="scp -i $HOME/.ssh/deploy_key -o IdentitiesOnly=yes"
@@ -94,7 +94,7 @@ jobs:
         if: github.ref == 'refs/heads/main' || github.ref == 'refs/heads/master'
         run: |
           set -euxo pipefail
-          : "${VPS_HOST:?Set repository variable VPS_HOST}"
+          : "${VPS_HOST:?Set repository secret VPS_HOST}"
           : "${VPS_USER:=root}"
           SSH="ssh -i $HOME/.ssh/deploy_key -o IdentitiesOnly=yes"
 
@@ -173,7 +173,7 @@ jobs:
         if: github.ref == 'refs/heads/main' || github.ref == 'refs/heads/master'
         run: |
           set -euxo pipefail
-          : "${VPS_HOST:?Set repository variable VPS_HOST}"
+          : "${VPS_HOST:?Set repository secret VPS_HOST}"
           : "${VPS_USER:=root}"
           SSH="ssh -i $HOME/.ssh/deploy_key -o IdentitiesOnly=yes"