diff --git a/bin/register-webhooks.sh b/bin/register-webhooks.sh
index 2d7e84d..71f3e47 100755
--- a/bin/register-webhooks.sh
+++ b/bin/register-webhooks.sh
@@ -12,17 +12,16 @@
 #
 # The secret must be the same value the serving host reads from
 # webhookSecretFile; a mismatch makes every delivery fail the HMAC check and
-# the repo silently stops updating. Pipe it straight out of sops so it reaches
-# neither the terminal nor the shell history:
+# the repo silently stops updating.
 #
-#   <redacted>
+# Both are taken from the environment rather than arguments, so pipe them in
+# from wherever they are kept — an argv is visible to every other process on
+# the box, and a pasted secret stays in the shell history.
+#
+# Usage:
 #   FORGEJO_TOKEN=<token with repo:write on each app repo> \
-#   FDROID_WEBHOOK_SECRET=$(<redacted>=<redacted> \
-#     nix run nixpkgs#sops -- -d --extract '["fdroid_webhook_secret"]' \
-#     <redacted>) \
-#     ../fdroid-repo/bin/register-webhooks.sh
-#
-# Usage: register-webhooks.sh [base-url]
+#   FDROID_WEBHOOK_SECRET=<the shared webhook secret> \
+#     register-webhooks.sh [base-url]
 set -euo pipefail
 
 cd "$(dirname "$0")/.."