diff --git a/.woodpecker.yml b/.woodpecker.yml
index e1c35eb..5524d8b 100644
--- a/.woodpecker.yml
+++ b/.woodpecker.yml
@@ -1,4 +1,3 @@
-# 只调度到你的 macOS 本机 agent（local/exec）
 labels:
   host: Mac-mini.local
   platform: darwin/arm64
@@ -14,11 +13,16 @@ steps:
   - name: upload-hello-txt
     image: /bin/zsh
     environment:
-      AWS_ACCESS_KEY_ID:      ${AWS_ACCESS_KEY_ID}
-      AWS_SECRET_ACCESS_KEY:  ${AWS_SECRET_ACCESS_KEY}
-      AWS_DEFAULT_REGION:     ${AWS_DEFAULT_REGION}
-      S3_BUCKET:              ${S3_BUCKET}
-      S3_ENDPOINT:            ${S3_ENDPOINT}
+      AWS_ACCESS_KEY_ID:
+        from_secret: AWS_ACCESS_KEY_ID
+      AWS_SECRET_ACCESS_KEY:
+        from_secret: AWS_SECRET_ACCESS_KEY
+      AWS_DEFAULT_REGION:
+        from_secret: AWS_DEFAULT_REGION
+      S3_BUCKET:
+        from_secret: S3_BUCKET
+      S3_ENDPOINT:
+        from_secret: S3_ENDPOINT
     commands:
       - |
         set -e
@@ -26,7 +30,7 @@ steps:
         echo "AWS_ACCESS_KEY_ID is set: $([[ -n "$AWS_ACCESS_KEY_ID" ]] && echo 'YES' || echo 'NO')"
         echo "AWS_SECRET_ACCESS_KEY is set: $([[ -n "$AWS_SECRET_ACCESS_KEY" ]] && echo 'YES' || echo 'NO')"
         echo "S3_BUCKET is set: $([[ -n "$S3_BUCKET" ]] && echo 'YES' || echo 'NO')"
-        echo "S3_ENDPOINT value: ${S3_ENDPOINT:-'NOT SET'}"
+        echo "S3_ENDPOINT: ${S3_ENDPOINT:-'NOT SET'}"
         echo "================"
         
         if [[ -n "$AWS_ACCESS_KEY_ID" && -n "$AWS_SECRET_ACCESS_KEY" && -n "$S3_BUCKET" ]]; then
@@ -40,21 +44,25 @@ steps:
         else
           echo "⚠️ No S3 credentials found. Skipping upload."
         fi
-          
+        
   - name: s3-upload-demo
     image: /bin/zsh
     environment:
-      AWS_ACCESS_KEY_ID:      ${AWS_ACCESS_KEY_ID}
-      AWS_SECRET_ACCESS_KEY:  ${AWS_SECRET_ACCESS_KEY}
-      AWS_DEFAULT_REGION:     ${AWS_DEFAULT_REGION}
-      S3_BUCKET:              ${S3_BUCKET}
-      S3_ENDPOINT:            ${S3_ENDPOINT}
+      AWS_ACCESS_KEY_ID:
+        from_secret: AWS_ACCESS_KEY_ID
+      AWS_SECRET_ACCESS_KEY:
+        from_secret: AWS_SECRET_ACCESS_KEY
+      AWS_DEFAULT_REGION:
+        from_secret: AWS_DEFAULT_REGION
+      S3_BUCKET:
+        from_secret: S3_BUCKET
+      S3_ENDPOINT:
+        from_secret: S3_ENDPOINT
     commands:
       - |
         set -e
         if [[ -n "$AWS_ACCESS_KEY_ID" && -n "$AWS_SECRET_ACCESS_KEY" && -n "$S3_BUCKET" ]]; then
           echo "Hello S3 from Woodpecker at $(date)" > s3-demo.txt
-          # plugin-s3 的环境变量（与容器版一致）
           export PLUGIN_SOURCE="s3-demo.txt"
           export PLUGIN_BUCKET="$S3_BUCKET"
           export PLUGIN_TARGET="woodpecker-demo/"