diff --git a/.woodpecker.yml b/.woodpecker.yml
index f8aa557..0ea9611 100644
--- a/.woodpecker.yml
+++ b/.woodpecker.yml
@@ -44,12 +44,17 @@ steps:
                 - name: migrate
                   image: localhost:5000/studio-auth-be:0.1.1
                   imagePullPolicy: Always
-                  command: ["sh", "-lc", "bunx --no-install prisma migrate deploy"]
+                  command:
+                    - sh
+                    - -lc
+                    - |
+                      export DATABASE_URL="postgresql://\${POSTGRES_USER}:\$(bun -e 'process.stdout.write(encodeURIComponent(process.env.POSTGRES_PASSWORD ?? ""))')@studio-auth-db.studio-system.svc.cluster.local:5432/\${POSTGRES_DB}?schema=public"
+                      bunx --no-install prisma migrate deploy
                   envFrom:
-                    - configMapRef:
-                        name: studio-auth-be-env
                     - secretRef:
                         name: studio-auth-be-env
+                    - secretRef:
+                        name: studio-auth-db-secret
         EOF
         if ! kubectl --kubeconfig=/tmp/kubeconfig -n studio-system wait --for=condition=complete "job/$job" --timeout=180s; then
           kubectl --kubeconfig=/tmp/kubeconfig -n studio-system logs "job/$job" --all-containers=true || true
diff --git a/k8s/auth-be.yaml b/k8s/auth-be.yaml
index 4f4629e..7c0ca4d 100644
--- a/k8s/auth-be.yaml
+++ b/k8s/auth-be.yaml
@@ -33,7 +33,5 @@ spec:
           ports:
             - containerPort: 4100
           envFrom:
-            - configMapRef:
-                name: studio-auth-be-env
             - secretRef:
                 name: studio-auth-be-env