diff --git a/.woodpecker/plugins.yaml b/.woodpecker/plugins.yaml
index 776650f..0d4d22c 100644
--- a/.woodpecker/plugins.yaml
+++ b/.woodpecker/plugins.yaml
@@ -26,10 +26,9 @@ steps:
       context: woodpecker/deploy
       dockerfile: woodpecker/deploy/Dockerfile
       tags: ${CI_COMMIT_TAG##deploy-}
-      username:
-        from_secret: registry_username
+      username: oumta-ci
       password:
-        from_secret: registry_password
+        from_secret: oumta_ci_token
     when:
       event: tag
       ref: refs/tags/deploy-v*
@@ -53,10 +52,9 @@ steps:
       context: woodpecker/bump
       dockerfile: woodpecker/bump/Dockerfile
       tags: ${CI_COMMIT_TAG##bump-}
-      username:
-        from_secret: registry_username
+      username: oumta-ci
       password:
-        from_secret: registry_password
+        from_secret: oumta_ci_token
     when:
       event: tag
       ref: refs/tags/bump-v*
diff --git a/README.md b/README.md
index f6fce1e..4a0c13b 100644
--- a/README.md
+++ b/README.md
@@ -129,8 +129,8 @@ Writes a pushed dev or beta image with its digest to `tanztee/oumta-deploy` (D16
 Settings:
 
 - `var` (required): variable in `envs/<env>/images.env`, e.g. `AUTH_IMAGE`. `{major}` is replaced by the major of the tag (`APP_V{major}_IMAGE` -> `APP_V2_IMAGE`).
-- `deploy_token` (required): token of `oumta-ci`, write access to oumta-deploy only. Limit the secret to this image and the events `tag` and `manual`.
-- `registry_username`, `registry_password`: read access to the registry for the digest
+- `deploy_token` (required): token of `oumta-ci` (`oumta_ci_token`), write access to oumta-deploy
+- `registry_username`, `registry_password`: read access to the registry for the digest (`oumta-ci` with the same token)
 - `envs`: fixed environments instead of the tag rule, e.g. `dev beta` (oumta-keyklo)
 - `tag`: default `CI_COMMIT_TAG`
 - `registry`: default `git.uesome.de`
@@ -152,19 +152,17 @@ steps:
       registry: git.uesome.de
       repo: git.uesome.de/tanztee/oumta-auth
       tags: ${CI_COMMIT_TAG}
-      username:
-        from_secret: registry_username
+      username: oumta-ci
       password:
-        from_secret: registry_password
+        from_secret: oumta_ci_token
 
   - name: deploy
     image: git.uesome.de/actions/ci-cd/deploy:v1.0.0
     settings:
       var: AUTH_IMAGE
-      registry_username:
-        from_secret: registry_username
+      registry_username: oumta-ci
       registry_password:
-        from_secret: registry_password
+        from_secret: oumta_ci_token
       deploy_token:
         from_secret: oumta_ci_token
 ```