diff --git a/.github/workflows/cli_release.yaml b/.github/workflows/cli_release.yaml
index 76e48e72e60..dfbfa653454 100644
--- a/.github/workflows/cli_release.yaml
+++ b/.github/workflows/cli_release.yaml
@@ -92,7 +92,7 @@ jobs:
     - name: Sign CLI release
       env:
         REF: ${{ github.event.ref }}
-        AC_PASSWD: ${{ secrets.APPLE_ID_PASSWORD }}
+        AC_PASSWORD: ${{ secrets.APPLE_ID_PASSWORD }}
         KEYCHAIN_PASSWORD: ${{ secrets.APPLE_KEYCHAIN_PASSWORD }}
         CERT_BASE64: ${{ secrets.APPLE_SIGN_CERT_B64 }}
         CERT_PASSWORD: ${{ secrets.APPLE_SIGN_CERT_PASSWORD }}
diff --git a/ci/gon.hcl b/ci/gon.hcl
index a21fadf48b0..624e84dd327 100644
--- a/ci/gon.hcl
+++ b/ci/gon.hcl
@@ -6,7 +6,7 @@ bundle_id = "ai.getcosmic.px"
 
 apple_id {
   username = "apple-dev@getcosmic.ai"
-  password = "@env:AC_PASSWD"
+  # Password is provided via AC_PASSWORD env var
   provider = "769M9XJDG6"
 }