diff --git a/.woodpecker/ci.yml b/.woodpecker/ci.yml
index 6c232c5..1b4f90c 100644
--- a/.woodpecker/ci.yml
+++ b/.woodpecker/ci.yml
@@ -6,8 +6,8 @@ when:
   - event: [push, pull_request, manual]
 
 # Turbo remote cache is at turbo.mosaicstack.dev (ducktors/turborepo-remote-cache).
-# TURBO_TOKEN is set as a Woodpecker secret. Turbo picks up TURBO_API, TURBO_TOKEN,
-# and TURBO_TEAM from the environment automatically.
+# TURBO_TOKEN is a Woodpecker secret injected via from_secret into the environment.
+# Turbo picks up TURBO_API, TURBO_TOKEN, and TURBO_TEAM automatically.
 
 steps:
   install:
@@ -21,7 +21,8 @@ steps:
     environment:
       TURBO_API: https://turbo.mosaicstack.dev
       TURBO_TEAM: mosaic
-    secrets: [turbo_token]
+      TURBO_TOKEN:
+        from_secret: turbo_token
     commands:
       - *enable_pnpm
       - pnpm typecheck
@@ -34,7 +35,8 @@ steps:
     environment:
       TURBO_API: https://turbo.mosaicstack.dev
       TURBO_TEAM: mosaic
-    secrets: [turbo_token]
+      TURBO_TOKEN:
+        from_secret: turbo_token
     commands:
       - *enable_pnpm
       - pnpm lint
@@ -54,7 +56,8 @@ steps:
     environment:
       TURBO_API: https://turbo.mosaicstack.dev
       TURBO_TEAM: mosaic
-    secrets: [turbo_token]
+      TURBO_TOKEN:
+        from_secret: turbo_token
     commands:
       - *enable_pnpm
       - pnpm test
@@ -66,7 +69,8 @@ steps:
     environment:
       TURBO_API: https://turbo.mosaicstack.dev
       TURBO_TEAM: mosaic
-    secrets: [turbo_token]
+      TURBO_TOKEN:
+        from_secret: turbo_token
     commands:
       - *enable_pnpm
       - pnpm build