diff --git a/.gitea/workflows/deploy-scp.yaml b/.gitea/workflows/deploy-scp.yaml
index 8b168db..13035c1 100644
--- a/.gitea/workflows/deploy-scp.yaml
+++ b/.gitea/workflows/deploy-scp.yaml
@@ -76,13 +76,18 @@ jobs:
       # literal, unresolved `${{ inputs.environment }}` text in the log.
       - name: Back up database
         if: ${{ inputs.run_db_backup }}
+        env:
+          SSH_USER: ${{ secrets.PI_MAIN_USERNAME }}
+          SSH_PASS: ${{ secrets.PI_MAIN_PASSWORD }}
+          SSH_PORT: ${{ secrets.PI_MAIN_PORT }}
+          SSH_HOST: ${{ secrets.PI_MAIN_ADDRESS }}
         run: |
           echo "Environment: ${{ inputs.environment }}"
           sudo apt-get update && sudo apt-get install -y sshpass
-          sshpass -p "${{ secrets.PI_MAIN_PASSWORD }}" ssh \
-            -p ${{ secrets.PI_MAIN_PORT }} \
+          sshpass -p "$SSH_PASS" ssh \
+            -p "$SSH_PORT" \
             -o StrictHostKeyChecking=no \
-            ${{ secrets.PI_MAIN_USERNAME }}@${{ secrets.PI_MAIN_ADDRESS }} \
+            "$SSH_USER@$SSH_HOST" \
             "bash ~/scripts/backup-slpsoftware-db.sh ${{ inputs.environment }}"
 
       # Uploads the published output to a fresh, timestamped release directory rather than
@@ -95,20 +100,25 @@ jobs:
       # actions rely on (D-05). A plain scp command needs no nested container.
       # Same Gitea Actions limitation as the step above — static name, value logged via echo instead.
       - name: Upload release
+        env:
+          SSH_USER: ${{ secrets.PI_MAIN_USERNAME }}
+          SSH_PASS: ${{ secrets.PI_MAIN_PASSWORD }}
+          SSH_PORT: ${{ secrets.PI_MAIN_PORT }}
+          SSH_HOST: ${{ secrets.PI_MAIN_ADDRESS }}
         run: |
           echo "Environment: ${{ inputs.environment }}, transport: ${{ inputs.transport }}"
           sudo apt-get update && sudo apt-get install -y sshpass
           RELEASE_DIR="${{ inputs.deploy_path }}/releases/${{ steps.release.outputs.timestamp }}"
-          sshpass -p "${{ secrets.PI_MAIN_PASSWORD }}" ssh \
-            -p ${{ secrets.PI_MAIN_PORT }} \
+          sshpass -p "$SSH_PASS" ssh \
+            -p "$SSH_PORT" \
             -o StrictHostKeyChecking=no \
-            ${{ secrets.PI_MAIN_USERNAME }}@${{ secrets.PI_MAIN_ADDRESS }} \
+            "$SSH_USER@$SSH_HOST" \
             "mkdir -p $RELEASE_DIR"
-          sshpass -p "${{ secrets.PI_MAIN_PASSWORD }}" scp \
-            -P ${{ secrets.PI_MAIN_PORT }} \
+          sshpass -p "$SSH_PASS" scp \
+            -P "$SSH_PORT" \
             -o StrictHostKeyChecking=no \
             -r ${{ inputs.artifact_name }}/* \
-            ${{ secrets.PI_MAIN_USERNAME }}@${{ secrets.PI_MAIN_ADDRESS }}:"$RELEASE_DIR"/
+            "$SSH_USER@$SSH_HOST:$RELEASE_DIR/"
 
       # The customer's public website (wwwroot/web) must survive every CMS deploy (FR-08, ASM-01).
       # It lives outside the swapped release directory in a persistent shared/ folder, and is
@@ -118,12 +128,17 @@ jobs:
       # containing only the placeholder page) is removed before the symlink is created, so it never
       # shadows the persistent content.
       - name: Link persistent website content
+        env:
+          SSH_USER: ${{ secrets.PI_MAIN_USERNAME }}
+          SSH_PASS: ${{ secrets.PI_MAIN_PASSWORD }}
+          SSH_PORT: ${{ secrets.PI_MAIN_PORT }}
+          SSH_HOST: ${{ secrets.PI_MAIN_ADDRESS }}
         run: |
           RELEASE_DIR="${{ inputs.deploy_path }}/releases/${{ steps.release.outputs.timestamp }}"
-          sshpass -p "${{ secrets.PI_MAIN_PASSWORD }}" ssh \
-            -p ${{ secrets.PI_MAIN_PORT }} \
+          sshpass -p "$SSH_PASS" ssh \
+            -p "$SSH_PORT" \
             -o StrictHostKeyChecking=no \
-            ${{ secrets.PI_MAIN_USERNAME }}@${{ secrets.PI_MAIN_ADDRESS }} \
+            "$SSH_USER@$SSH_HOST" \
             "mkdir -p ${{ inputs.deploy_path }}/shared/wwwroot-web && \
              rm -rf $RELEASE_DIR/wwwroot/web && \
              ln -s ../../../shared/wwwroot-web $RELEASE_DIR/wwwroot/web"
@@ -133,12 +148,17 @@ jobs:
       # directory. The process is then restarted so it picks up the new assemblies — a running .NET
       # process holds on to the ones it already loaded.
       - name: Switch current release and restart service
+        env:
+          SSH_USER: ${{ secrets.PI_MAIN_USERNAME }}
+          SSH_PASS: ${{ secrets.PI_MAIN_PASSWORD }}
+          SSH_PORT: ${{ secrets.PI_MAIN_PORT }}
+          SSH_HOST: ${{ secrets.PI_MAIN_ADDRESS }}
         run: |
           RELEASE_DIR="${{ inputs.deploy_path }}/releases/${{ steps.release.outputs.timestamp }}"
-          sshpass -p "${{ secrets.PI_MAIN_PASSWORD }}" ssh \
-            -p ${{ secrets.PI_MAIN_PORT }} \
+          sshpass -p "$SSH_PASS" ssh \
+            -p "$SSH_PORT" \
             -o StrictHostKeyChecking=no \
-            ${{ secrets.PI_MAIN_USERNAME }}@${{ secrets.PI_MAIN_ADDRESS }} \
+            "$SSH_USER@$SSH_HOST" \
             "ln -sfn $RELEASE_DIR ${{ inputs.deploy_path }}/current && \
              systemctl --user restart ${{ inputs.service_name }}"
 
@@ -163,9 +183,14 @@ jobs:
       # a re-point-and-restart away without rebuilding. Only runs after a passing health check —
       # pruning after a failed check could leave the only other release as the sole survivor.
       - name: Prune old releases
+        env:
+          SSH_USER: ${{ secrets.PI_MAIN_USERNAME }}
+          SSH_PASS: ${{ secrets.PI_MAIN_PASSWORD }}
+          SSH_PORT: ${{ secrets.PI_MAIN_PORT }}
+          SSH_HOST: ${{ secrets.PI_MAIN_ADDRESS }}
         run: |
-          sshpass -p "${{ secrets.PI_MAIN_PASSWORD }}" ssh \
-            -p ${{ secrets.PI_MAIN_PORT }} \
+          sshpass -p "$SSH_PASS" ssh \
+            -p "$SSH_PORT" \
             -o StrictHostKeyChecking=no \
-            ${{ secrets.PI_MAIN_USERNAME }}@${{ secrets.PI_MAIN_ADDRESS }} \
+            "$SSH_USER@$SSH_HOST" \
             "cd ${{ inputs.deploy_path }}/releases && ls -1t | tail -n +3 | xargs -r rm -rf"