diff --git a/.woodpecker/dns.yml b/.woodpecker/dns.yml
index b4cb176..c1f824a 100644
--- a/.woodpecker/dns.yml
+++ b/.woodpecker/dns.yml
@@ -4,18 +4,17 @@ pipeline:
     when:
       path: "dns/**"
       event: pull_request
-    secrets:
-      - linode_token
-      - aws_access_key_id
-      - aws_secret_access_key
     commands:
       - apk add --no-cache terraform
       - terraform version
       - cd dns
-      - echo "linode token $LINODE_TOKEN"
       - terraform init
       - terraform validate
       - terraform plan -var "token=$LINODE_TOKEN"
+    secrets:
+      - linode_token
+      - aws_access_key_id
+      - aws_secret_access_key
 
   deploy:
     image: alpine:3.16
@@ -23,10 +22,6 @@ pipeline:
       path: "dns/**"
       branch: main
       event: push
-    secrets:
-      - linode_token
-      - aws_access_key_id
-      - aws_secret_access_key
     commands:
       - apk add --no-cache terraform
       - terraform version
@@ -35,3 +30,7 @@ pipeline:
       - terraform validate
       - terraform plan -out deploy.plan -var "token=$LINODE_TOKEN"
       - terraform apply deploy.plan -var "token=$LINODE_TOKEN"
+    secrets:
+      - linode_token
+      - aws_access_key_id
+      - aws_secret_access_key