diff --git a/.woodpecker.yml b/.woodpecker.yml
index af892aa..aa41544 100644
--- a/.woodpecker.yml
+++ b/.woodpecker.yml
@@ -106,7 +106,7 @@ steps:
     image: google/cloud-sdk:latest
     entrypoint:
       - bash
-      - -lc
+      - -c
       - |
         set -euo pipefail
         [[ "${PROMOTE:-}" == "prod" ]] || { echo "⏭ Skipping (PROMOTE=$PROMOTE)"; exit 0; }
@@ -171,7 +171,7 @@ steps:
             SERVER2_PORT="$(gcloud secrets versions access latest --secret=SERVER2_PORT_$ENV --project="$PROJECT")"; export SERVER2_PORT
             SERVER3_PORT="$(gcloud secrets versions access latest --secret=SERVER3_PORT_$ENV --project="$PROJECT")"; export SERVER3_PORT
             ENV_NAME="$(gcloud secrets versions access latest --secret=ENV_NAME_$ENV --project="$PROJECT")"; export ENV_NAME
-            CORS_ALLOWED_ORIGINS="$(gcloud secrets versions access latest --secret=CORS_ALLOWED_ORIGINS_$ENV --project="$PROJECT"
+            CORS_ALLOWED_ORIGINS="$(gcloud secrets versions access latest --secret=CORS_ALLOWED_ORIGINS_$ENV --project="$PROJECT"); export CORS_ALLOWED_ORIGINS
             APTIVA_API_BASE="$(gcloud secrets versions access latest --secret=APTIVA_API_BASE_$ENV --project="$PROJECT")"; export APTIVA_API_BASE
             TOKEN_MAX_AGE_MS="$(gcloud secrets versions access latest --secret=TOKEN_MAX_AGE_MS_$ENV --project="$PROJECT")"; export TOKEN_MAX_AGE_MS
             COOKIE_SECURE="$(gcloud secrets versions access latest --secret=COOKIE_SECURE_$ENV --project="$PROJECT")"; export COOKIE_SECURE