diff --git a/.drone.yml b/.drone.yml
index a40fd2b..571e3bc 100644
--- a/.drone.yml
+++ b/.drone.yml
@@ -125,13 +125,15 @@ steps:
       - apk add --no-cache openssh-client
       - mkdir -p /root/.ssh && chmod 700 /root/.ssh
       - printenv SSH_KEY > /root/.ssh/id_ed25519 && chmod 600 /root/.ssh/id_ed25519
+      # Drone pre-expands ${VAR} (empty for secrets). Use $VAR / $$ so the shell
+      # reads the from_secret environment at runtime.
       - |
         ssh -i /root/.ssh/id_ed25519 \
-          -p "${SSH_PORT:-22}" \
+          -p "$${SSH_PORT:-22}" \
           -o StrictHostKeyChecking=accept-new \
           -o BatchMode=yes \
-          "${SSH_USER}@${SSH_HOST}" \
-          "export REGISTRY_USERNAME='${REGISTRY_USERNAME}' REGISTRY_PASSWORD='${REGISTRY_PASSWORD}'; bash -s" <<'EOS'
+          "$${SSH_USER}@$${SSH_HOST}" \
+          "export REGISTRY_USERNAME='$${REGISTRY_USERNAME}' REGISTRY_PASSWORD='$${REGISTRY_PASSWORD}'; bash -s" <<'EOS'
         set -euo pipefail
         echo "${REGISTRY_PASSWORD}" | docker login registry.zea.lt -u "${REGISTRY_USERNAME}" --password-stdin
         cd /home/miczek/homelab/tracker