diff --git a/.woodpecker.yml b/.woodpecker.yml
index 45cdd67..a377134 100644
--- a/.woodpecker.yml
+++ b/.woodpecker.yml
@@ -129,7 +129,7 @@ steps:
           --listen-on-stdin --verbosity=error" \
           -o StrictHostKeyChecking=accept-new \
           -i ~/.ssh/id_ed25519 \
-          "$PROD_SSH_TARGET" bash -s -- "$IMG_TAG" <<'EOF'
+          "$PROD_SSH_TARGET" bash -s -- "$IMG_TAG"
           set -euo pipefail
           IMG_TAG="${1:?IMG_TAG arg missing}"
           export IMG_TAG
@@ -171,7 +171,7 @@ steps:
             SERVER2_PORT="$(gcloud secrets versions access latest --secret=SERVER2_PORT_$ENV --project="$PROJECT")"; export SERVER2_PORT
             SERVER3_PORT="$(gcloud secrets versions access latest --secret=SERVER3_PORT_$ENV --project="$PROJECT")"; export SERVER3_PORT
             ENV_NAME="$(gcloud secrets versions access latest --secret=ENV_NAME_$ENV --project="$PROJECT")"; export ENV_NAME
-            CORS_ALLOWED_ORIGINS="$(gcloud secrets versions access latest --secret=CORS_ALLOWED_ORIGINS_$ENV --project="$PROJECT" 2>/dev/null || true)"; export CORS_ALLOWED_ORIGINS="${CORS_ALLOWED_ORIGINS:-}"
+            CORS_ALLOWED_ORIGINS="$(gcloud secrets versions access latest --secret=CORS_ALLOWED_ORIGINS_$ENV --project="$PROJECT"
             APTIVA_API_BASE="$(gcloud secrets versions access latest --secret=APTIVA_API_BASE_$ENV --project="$PROJECT")"; export APTIVA_API_BASE
             TOKEN_MAX_AGE_MS="$(gcloud secrets versions access latest --secret=TOKEN_MAX_AGE_MS_$ENV --project="$PROJECT")"; export TOKEN_MAX_AGE_MS
             COOKIE_SECURE="$(gcloud secrets versions access latest --secret=COOKIE_SECURE_$ENV --project="$PROJECT")"; export COOKIE_SECURE