diff --git a/setup.sh b/setup.sh
index ff53003..ecd3e86 100755
--- a/setup.sh
+++ b/setup.sh
@@ -32,7 +32,7 @@ echo "==> Upgrading system packages..."
 dnf upgrade -y
 
 echo "==> Installing dependencies..."
-dnf install -y git-crypt
+dnf install -y git-crypt jq
 dnf module reset -y nodejs
 dnf module install -y nodejs:20/common
 
@@ -59,6 +59,10 @@ BW_SESSION=$("$BW_CLI" unlock --raw)
 cd "$REPO_DIR"
 git-crypt unlock /tmp/git-crypt-key
 rm /tmp/git-crypt-key
+
+echo "==> Fetching secrets from Bitwarden..."
+REGISTRY_TOKEN=$("$BW_CLI" get password hantim-ci-registry-push --session "$BW_SESSION")
+DEPLOY_PUBKEY=$("$BW_CLI" get item hantim-server-deploy --session "$BW_SESSION" | jq -r '.sshKey.publicKey')
 "$BW_CLI" lock
 
 # --- Install Docker ---
@@ -71,6 +75,9 @@ if ! command -v docker &>/dev/null; then
 fi
 systemctl enable --now docker
 
+echo "==> Logging into Gitea Docker registry..."
+echo "$REGISTRY_TOKEN" | docker login git.timothykim.net -u timothykim --password-stdin
+
 # --- Create deploy user ---
 
 if ! id deploy &>/dev/null; then
@@ -82,11 +89,8 @@ usermod -aG docker deploy
 echo "==> Setting up deploy SSH key..."
 mkdir -p /home/deploy/.ssh
 chmod 700 /home/deploy/.ssh
-if [ ! -f /home/deploy/.ssh/authorized_keys ]; then
-    echo "WARNING: Add the CI public key manually:"
-    echo '  command="sudo /opt/hantim/scripts/deploy.sh $SSH_ORIGINAL_COMMAND",no-port-forwarding,no-agent-forwarding,no-X11-forwarding,no-pty ssh-ed25519 <KEY>'
-    echo "  into /home/deploy/.ssh/authorized_keys"
-fi
+echo "command=\"sudo /opt/hantim/scripts/deploy.sh \$SSH_ORIGINAL_COMMAND\",no-port-forwarding,no-agent-forwarding,no-X11-forwarding,no-pty $DEPLOY_PUBKEY" > /home/deploy/.ssh/authorized_keys
+chmod 600 /home/deploy/.ssh/authorized_keys
 chown -R deploy:deploy /home/deploy/.ssh
 
 echo "==> Configuring sudo for deploy user..."
@@ -100,9 +104,6 @@ chmod 440 /etc/sudoers.d/deploy
 echo "==> Making scripts executable..."
 chmod +x "$REPO_DIR/scripts/"*.sh
 
-echo "==> Logging into Gitea registry..."
-echo "Run manually: docker login git.timothykim.net"
-
 echo "==> Starting services..."
 cd "$REPO_DIR/docker/nginx"
 docker compose up -d
@@ -110,7 +111,5 @@ cd "$REPO_DIR/docker/timothykim.net"
 docker compose up -d
 
 echo "==> Done. Don't forget to:"
-echo "  1. Add the deploy SSH public key to /home/deploy/.ssh/authorized_keys"
-echo "  2. Log into the Gitea Docker registry: docker login git.timothykim.net"
-echo "  3. Configure Nginx Proxy Manager at http://<server-ip>:81"
-echo "  4. Restore NPM data/certs backup if migrating"
+echo "  1. Configure Nginx Proxy Manager at http://<server-ip>:81"
+echo "  2. Restore NPM data/certs backup if migrating"