diff --git a/.gitea/workflows/ci.yml b/.gitea/workflows/ci.yml
index f5d7df7..bab4fa2 100644
--- a/.gitea/workflows/ci.yml
+++ b/.gitea/workflows/ci.yml
@@ -80,8 +80,12 @@ jobs:
             -o gpu-turnstile.exe ./cmd/gpu-turnstile
 
       - name: Sign and checksum
+        env:
+          RELEASE_SIGNING_KEY: ${{ secrets.RELEASE_SIGNING_KEY }}
         run: |
-          printf '%s\n' "${{ secrets.RELEASE_SIGNING_KEY }}" > key.pem
+          # The key comes via the environment so its value never appears in
+          # the echoed command line of the run log.
+          printf '%s\n' "$RELEASE_SIGNING_KEY" > key.pem
           chmod 600 key.pem
           openssl pkeyutl -sign -inkey key.pem -rawin \
             -in gpu-turnstile.exe -out gpu-turnstile.exe.sig