diff --git a/manifests/bin/deploy.sh b/manifests/bin/deploy.sh
index 76318a6..51a83aa 100755
--- a/manifests/bin/deploy.sh
+++ b/manifests/bin/deploy.sh
@@ -1,11 +1,9 @@
 #!/bin/bash -e
 set -o pipefail
 
-set -x
 function kapply() {
     for f in "$@"; do
-        kubectl apply -f \
-            <(envsubst "$(env | xargs printf '$%s ')" < "manifests/$f")
+        kubectl apply -f <(envsubst < "manifests/$f")
     done
 }; export -f kapply
 
@@ -48,7 +46,7 @@ export POSTGRES_USER;     POSTGRES_USER="$(kgseckey postgres-app user)"
 export POSTGRES_PASSWORD; POSTGRES_PASSWORD="$(kgseckey postgres-app password)"
 
 # shellcheck disable=SC1090,SC2016
-. <(kubectl run -i --rm --image "docker.io/gitea/gitea:1.22.6-rootless" secrets -- bash <<< 'echo SECRET_KEY="$(gitea generate secret SECRET_KEY)" INTERNAL_TOKEN="$(gitea generate secret INTERNAL_TOKEN)" JWT_SECRET="$(gitea generate secret JWT_SECRET)"')
+. <(kubectl run -i --rm --image "docker.io/gitea/gitea:1.22.6-rootless" secrets -- bash <<< 'echo SECRET_KEY="$(gitea generate secret SECRET_KEY)" INTERNAL_TOKEN="$(gitea generate secret INTERNAL_TOKEN)" JWT_SECRET="$(gitea generate secret JWT_SECRET)"' | head -n1)
 
 kcreate gitea \
     --from-literal=secret_key="$(kgseckey gitea secret_key               || echo "$SECRET_KEY")" \
@@ -56,7 +54,7 @@ kcreate gitea \
     --from-literal=oauth2_jwt_secret="$(kgseckey gitea oauth2_jwt_secret || echo "$JWT_SECRET")"
 
 kcreatecm gitea \
-    --from-file=app.ini=<(envsubst "$(env | xargs printf '$%s ')" < config/app.ini)
+    --from-file=app.ini=<(envsubst < config/app.ini)
 
 kapply common/job.yaml \
     common/valkey.yaml \