diff --git a/.woodpecker.yml b/.woodpecker.yml
index 0ea9611..779d806 100644
--- a/.woodpecker.yml
+++ b/.woodpecker.yml
@@ -28,11 +28,11 @@ steps:
         commit="$(printf %.8s "$CI_COMMIT_SHA")"
         job="studio-auth-migrate-$commit"
         kubectl --kubeconfig=/tmp/kubeconfig -n studio-system delete job "$job" --ignore-not-found
-        cat <<EOF | kubectl --kubeconfig=/tmp/kubeconfig apply -f -
+        cat <<'EOF' | sed "s/__JOB_NAME__/$job/g" | kubectl --kubeconfig=/tmp/kubeconfig apply -f -
         apiVersion: batch/v1
         kind: Job
         metadata:
-          name: $job
+          name: __JOB_NAME__
           namespace: studio-system
         spec:
           backoffLimit: 1
@@ -48,7 +48,7 @@ steps:
                     - sh
                     - -lc
                     - |
-                      export DATABASE_URL="postgresql://\${POSTGRES_USER}:\$(bun -e 'process.stdout.write(encodeURIComponent(process.env.POSTGRES_PASSWORD ?? ""))')@studio-auth-db.studio-system.svc.cluster.local:5432/\${POSTGRES_DB}?schema=public"
+                      export DATABASE_URL="postgresql://$(printenv POSTGRES_USER):$(bun -e 'process.stdout.write(encodeURIComponent(process.env.POSTGRES_PASSWORD ?? ""))')@studio-auth-db.studio-system.svc.cluster.local:5432/$(printenv POSTGRES_DB)?schema=public"
                       bunx --no-install prisma migrate deploy
                   envFrom:
                     - secretRef: