diff --git a/.gitea/workflows/deploy-nginx.yml b/.gitea/workflows/deploy-nginx.yml
index b466749..9de5436 100644
--- a/.gitea/workflows/deploy-nginx.yml
+++ b/.gitea/workflows/deploy-nginx.yml
@@ -15,4 +15,4 @@ jobs:
           mkdir -p ~/.ssh
           echo "${{ secrets.DEPLOY_SSH_KEY }}" > ~/.ssh/deploy_key
           chmod 600 ~/.ssh/deploy_key
-          ssh -o StrictHostKeyChecking=accept-new -i ~/.ssh/deploy_key deploy@${{ secrets.DEPLOY_HOST }} deploy-nginx
+          ssh -o StrictHostKeyChecking=accept-new -i ~/.ssh/deploy_key deploy@${{ vars.DEPLOY_HOST }} deploy-nginx
diff --git a/.gitea/workflows/deploy-timothykim.yml b/.gitea/workflows/deploy-timothykim.yml
index 1a909ad..1a3315c 100644
--- a/.gitea/workflows/deploy-timothykim.yml
+++ b/.gitea/workflows/deploy-timothykim.yml
@@ -15,4 +15,4 @@ jobs:
           mkdir -p ~/.ssh
           echo "${{ secrets.DEPLOY_SSH_KEY }}" > ~/.ssh/deploy_key
           chmod 600 ~/.ssh/deploy_key
-          ssh -o StrictHostKeyChecking=accept-new -i ~/.ssh/deploy_key deploy@${{ secrets.DEPLOY_HOST }} deploy-timothykim.net
+          ssh -o StrictHostKeyChecking=accept-new -i ~/.ssh/deploy_key deploy@${{ vars.DEPLOY_HOST }} deploy-timothykim.net
diff --git a/README.md b/README.md
index 1d4e14c..c2087c1 100644
--- a/README.md
+++ b/README.md
@@ -84,9 +84,12 @@ After running the script:
 Nginx Proxy Manager certs and Let's Encrypt account keys are encrypted with
 git-crypt (see `.gitattributes`). You need the git-crypt key to unlock them.
 
-The following secrets must be configured in the `hantim` Gitea org settings
-(Settings > Actions > Secrets) and are shared across all repos:
+The following must be configured in the `hantim` Gitea org settings and are
+shared across all repos:
 
+Variables (Settings > Actions > Variables):
 - `DEPLOY_HOST` -- the server's IP or hostname
+
+Secrets (Settings > Actions > Secrets):
 - `DEPLOY_SSH_KEY` -- the SSH private key for the `deploy` user
 - `REGISTRY_TOKEN` -- Gitea personal access token for Docker registry login
diff --git a/scripts/new-app.sh b/scripts/new-app.sh
index f7ab45d..e265b4e 100755
--- a/scripts/new-app.sh
+++ b/scripts/new-app.sh
@@ -56,7 +56,7 @@ jobs:
           mkdir -p ~/.ssh
           echo "${{ secrets.DEPLOY_SSH_KEY }}" > ~/.ssh/deploy_key
           chmod 600 ~/.ssh/deploy_key
-          ssh -o StrictHostKeyChecking=accept-new -i ~/.ssh/deploy_key deploy@${{ secrets.DEPLOY_HOST }} deploy-APP_PLACEHOLDER
+          ssh -o StrictHostKeyChecking=accept-new -i ~/.ssh/deploy_key deploy@${{ vars.DEPLOY_HOST }} deploy-APP_PLACEHOLDER
 OUTER
 sed -i "s/APP_PLACEHOLDER/$APP/g" "$REPO_ROOT/.gitea/workflows/deploy-$APP.yml"