diff --git a/.drone.yml b/.drone.yml
index debf6e6..06c5fc0 100644
--- a/.drone.yml
+++ b/.drone.yml
@@ -3,18 +3,6 @@ kind: pipeline
 type: docker
 name: default
 
-environment:
-  HE_USERNAME:
-    from_secret: HE_USERNAME
-  HE_PASSWORD:
-    from_secret: HE_PASSWORD
-  HE_TOTPKEY:
-    from_secret: HE_TOTPKEY
-  CF_APITOKEN:
-    from_secret: CF_APITOKEN
-  CF_ACCOUNTID:
-    from_secret: CF_ACCOUNTID
-
 image_pull_secrets:
 - IMAGE_PULL_SECRET
 
@@ -22,6 +10,17 @@ steps:
 - name: Validate configuration and check changes
   image: registry.kmlabz.com/stargate-cluster/dnscontrol-docker
   pull: always
+  environment:
+    HE_USERNAME:
+      from_secret: HE_USERNAME
+    HE_PASSWORD:
+      from_secret: HE_PASSWORD
+    HE_TOTPKEY:
+      from_secret: HE_TOTPKEY
+    CF_APITOKEN:
+      from_secret: CF_APITOKEN
+    CF_ACCOUNTID:
+      from_secret: CF_ACCOUNTID
   commands:
     - dnscontrol preview