diff --git a/ARCHITECTURE.md b/ARCHITECTURE.md
index 73e8598..f76bead 100644
--- a/ARCHITECTURE.md
+++ b/ARCHITECTURE.md
@@ -119,7 +119,8 @@ cert as SANs.
 Services needing secrets declare them in `.env.keys`:
 
 ```
-ENV_VAR=bws-secret-name
+# bws-secret-name
+ENV_VAR=bws-secret-uuid
 ```
 
 During deploy, `deploy.sh`:
diff --git a/README.md b/README.md
index 3112f0f..655d105 100644
--- a/README.md
+++ b/README.md
@@ -200,8 +200,9 @@ Machine accounts: `hantim-server` (token at `/etc/bws-token`), `hantim-ci` (rese
 ### Service secrets (`.env.keys`)
 
 Services that need secrets declare them in `.env.keys` (format:
-`ENV_VAR=bws-secret-name`, one per line). `deploy.sh` fetches each secret
-from bws and generates `.env` before starting the service.
+`ENV_VAR=bws-secret-uuid`, one per line, with `# secret-name` comments).
+`deploy.sh` fetches each secret by UUID from bws and generates `.env`
+before starting the service.
 
 ### Gitea org-level secrets
 
diff --git a/docker/garage/.env.keys b/docker/garage/.env.keys
index 36e9b0c..2ee0bcf 100644
--- a/docker/garage/.env.keys
+++ b/docker/garage/.env.keys
@@ -1,3 +1,6 @@
-RPC_SECRET=hantim-garage-rpc-secret
-ARGENTO_NODE_ID=hantim-garage-argento-node-id
-ADMIN_TOKEN=hantim-garage-admin-token
+# hantim-garage-rpc-secret
+RPC_SECRET=076a4798-4180-4190-9212-b41200ff08e3
+# hantim-garage-argento-node-id
+ARGENTO_NODE_ID=98454088-faf7-4d36-b98a-b41200ff52dd
+# hantim-garage-admin-token
+ADMIN_TOKEN=5565abc1-cd9f-451e-97a2-b412015dbb53
diff --git a/scripts/deploy.sh b/scripts/deploy.sh
index c96889a..872da34 100755
--- a/scripts/deploy.sh
+++ b/scripts/deploy.sh
@@ -57,11 +57,12 @@ if [ -f "docker/$APP/.env.keys" ] && [ -f /etc/bws-token ]; then
     env_content=""
     while IFS= read -r line || [ -n "$line" ]; do
         [ -z "$line" ] && continue
+        [[ "$line" = \#* ]] && continue
         var_name="${line%%=*}"
-        secret_key="${line#*=}"
-        value=$(bws secret list | jq -r --arg key "$secret_key" '.[] | select(.key == $key) | .value')
+        secret_id="${line#*=}"
+        value=$(bws secret get "$secret_id" | jq -r .value)
         if [ -z "$value" ]; then
-            echo "ERROR: Secret '$secret_key' not found in bws."
+            echo "ERROR: Secret '$secret_id' not found in bws."
             echo "  Check that the secret exists and the machine account has access."
             exit 1
         fi