diff --git a/.forgejo/actions/update-aur-package/action.yaml b/.forgejo/actions/update-aur-package/action.yaml
index 552c5a1..c6eb24c 100644
--- a/.forgejo/actions/update-aur-package/action.yaml
+++ b/.forgejo/actions/update-aur-package/action.yaml
@@ -25,6 +25,15 @@ inputs:
     description: Treat the package as a VCS/git package and publish when PKGBUILD or .SRCINFO changes
     required: false
     default: 'false'
+  aur-ssh-private-key:
+    description: SSH private key to login to the AUR
+    required: true
+  pushover-api-token:
+    description: API token for Pushover service
+    required: true
+  pushover-user-key:
+    description: User key for Pushover service
+    required: true
 
 runs:
   using: composite
@@ -36,7 +45,7 @@ runs:
     - name: Setup SSH
       shell: bash
       env:
-        AUR_SSH_PRIVATE_KEY: ${{ secrets.AUR_SSH_PRIVATE_KEY }}
+        AUR_SSH_PRIVATE_KEY: ${{ inputs.aur-ssh-private-key }}
       run: |
         mkdir -p ~/.ssh
         echo "$AUR_SSH_PRIVATE_KEY" > ~/.ssh/id_ed25519
@@ -51,7 +60,7 @@ runs:
     - name: Update package
       id: update
       shell: bash
-      working-directory: ${{ env.FORGEJO_WORKSPACE }}/${{ inputs.package-name }}
+      working-directory: ${{ inputs.package-name }}
       run: |
         if [ "${{ inputs.git-package }}" != "true" ]; then
           sed -i "s/^pkgver=.*/pkgver=${{ inputs.upstream-version }}/" PKGBUILD
@@ -71,7 +80,7 @@ runs:
 
     - name: Test package
       shell: bash
-      working-directory: ${{ env.FORGEJO_WORKSPACE }}/${{ inputs.package-name }}
+      working-directory: ${{ inputs.package-name }}
       run: |
         makepkg -csi --noconfirm --noprogressbar
         namcap -i PKGBUILD
@@ -81,10 +90,10 @@ runs:
     - name: Upload new package
       if: ${{ inputs.git-package == 'true' && steps.update.outputs.modified == 'yes' || inputs.git-package != 'true' && inputs.upstream-version != inputs.aur-version }}
       shell: bash
-      working-directory: ${{ env.FORGEJO_WORKSPACE }}/${{ inputs.package-name }}
+      working-directory: ${{ inputs.package-name }}
       env:
-        PUSHOVER_API_TOKEN: ${{ secrets.PUSHOVER_API_TOKEN }}
-        PUSHOVER_USER_KEY: ${{ secrets.PUSHOVER_USER_KEY }}
+        PUSHOVER_API_TOKEN: ${{ inputs.pushover-api-token }}
+        PUSHOVER_USER_KEY: ${{ inputs.pushover-user-key }}
       run: |
         git config user.name "update-bot"
         git config user.email "email@ricardo.band"
@@ -107,8 +116,8 @@ runs:
       if: ${{ failure() }}
       shell: bash
       env:
-        PUSHOVER_API_TOKEN: ${{ secrets.PUSHOVER_API_TOKEN }}
-        PUSHOVER_USER_KEY: ${{ secrets.PUSHOVER_USER_KEY }}
+        PUSHOVER_API_TOKEN: ${{ inputs.pushover-api-token }}
+        PUSHOVER_USER_KEY: ${{ inputs.pushover-user-key }}
       run: |
         curl -sL \
           --form-string "token=$PUSHOVER_API_TOKEN" \
diff --git a/.forgejo/workflows/packages.yaml b/.forgejo/workflows/packages.yaml
index 8d59bb2..86ccbf1 100644
--- a/.forgejo/workflows/packages.yaml
+++ b/.forgejo/workflows/packages.yaml
@@ -32,6 +32,9 @@ jobs:
           test-command: go-aws-sso --help
           commit-message: bumped to version ${{ steps.versions.outputs.upstream }}
           notify-message: ${{ env.PACKAGE_NAME }} updated from ${{ steps.versions.outputs.aur }} to ${{ steps.versions.outputs.upstream }}
+          aur-ssh-private-key: ${{ secrets.AUR_SSH_PRIVATE_KEY }}
+          pushover-api-token: ${{ secrets.PUSHOVER_API_TOKEN }}
+          pushover-user-key: ${{ secrets.PUSHOVER_USER_KEY }}
 
   yawsso:
     runs-on: debian-stable
@@ -58,6 +61,9 @@ jobs:
           test-command: yawsso --help
           commit-message: bumped to version ${{ steps.versions.outputs.upstream }}
           notify-message: ${{ env.PACKAGE_NAME }} updated from ${{ steps.versions.outputs.aur }} to ${{ steps.versions.outputs.upstream }}
+          aur-ssh-private-key: ${{ secrets.AUR_SSH_PRIVATE_KEY }}
+          pushover-api-token: ${{ secrets.PUSHOVER_API_TOKEN }}
+          pushover-user-key: ${{ secrets.PUSHOVER_USER_KEY }}
 
   sensu-go:
     runs-on: debian-stable
@@ -87,6 +93,9 @@ jobs:
             sensuctl --help
           commit-message: bumped to version ${{ steps.versions.outputs.upstream }}
           notify-message: ${{ env.PACKAGE_NAME }} updated from ${{ steps.versions.outputs.aur }} to ${{ steps.versions.outputs.upstream }}
+          aur-ssh-private-key: ${{ secrets.AUR_SSH_PRIVATE_KEY }}
+          pushover-api-token: ${{ secrets.PUSHOVER_API_TOKEN }}
+          pushover-user-key: ${{ secrets.PUSHOVER_USER_KEY }}
 
   cephadm:
     runs-on: debian-stable
@@ -122,6 +131,9 @@ jobs:
           test-command: sudo cephadm --help
           commit-message: bumped to version ${{ steps.versions.outputs.upstream }}
           notify-message: ${{ env.PACKAGE_NAME }} updated from ${{ steps.versions.outputs.aur }} to ${{ steps.versions.outputs.upstream }}
+          aur-ssh-private-key: ${{ secrets.AUR_SSH_PRIVATE_KEY }}
+          pushover-api-token: ${{ secrets.PUSHOVER_API_TOKEN }}
+          pushover-user-key: ${{ secrets.PUSHOVER_USER_KEY }}
 
   cephadm-git:
     runs-on: debian-stable
@@ -145,6 +157,9 @@ jobs:
           test-command: sudo cephadm --help
           commit-message: bumped git commit
           notify-message: ${{ env.PACKAGE_NAME }} updated git commit
+          aur-ssh-private-key: ${{ secrets.AUR_SSH_PRIVATE_KEY }}
+          pushover-api-token: ${{ secrets.PUSHOVER_API_TOKEN }}
+          pushover-user-key: ${{ secrets.PUSHOVER_USER_KEY }}
 
   virtualfish:
     runs-on: debian-stable
@@ -174,6 +189,9 @@ jobs:
             fish -c 'vf --help'
           commit-message: bumped to version ${{ steps.versions.outputs.upstream }}
           notify-message: ${{ env.PACKAGE_NAME }} updated from ${{ steps.versions.outputs.aur }} to ${{ steps.versions.outputs.upstream }}
+          aur-ssh-private-key: ${{ secrets.AUR_SSH_PRIVATE_KEY }}
+          pushover-api-token: ${{ secrets.PUSHOVER_API_TOKEN }}
+          pushover-user-key: ${{ secrets.PUSHOVER_USER_KEY }}
 
   projen:
     runs-on: debian-stable
@@ -200,6 +218,9 @@ jobs:
           test-command: projen --help
           commit-message: bumped to version ${{ steps.versions.outputs.upstream }}
           notify-message: ${{ env.PACKAGE_NAME }} updated from ${{ steps.versions.outputs.aur }} to ${{ steps.versions.outputs.upstream }}
+          aur-ssh-private-key: ${{ secrets.AUR_SSH_PRIVATE_KEY }}
+          pushover-api-token: ${{ secrets.PUSHOVER_API_TOKEN }}
+          pushover-user-key: ${{ secrets.PUSHOVER_USER_KEY }}
 
   rqlite:
     runs-on: debian-stable
@@ -228,6 +249,9 @@ jobs:
             rqlite --help
           commit-message: bumped to version ${{ steps.versions.outputs.upstream }}
           notify-message: ${{ env.PACKAGE_NAME }} updated from ${{ steps.versions.outputs.aur }} to ${{ steps.versions.outputs.upstream }}
+          aur-ssh-private-key: ${{ secrets.AUR_SSH_PRIVATE_KEY }}
+          pushover-api-token: ${{ secrets.PUSHOVER_API_TOKEN }}
+          pushover-user-key: ${{ secrets.PUSHOVER_USER_KEY }}
 
   update-readme:
     runs-on: alpine-latest