diff --git a/.gitea/workflows/deploy.yml b/.gitea/workflows/deploy.yml
index e590fb3..24c6642 100644
--- a/.gitea/workflows/deploy.yml
+++ b/.gitea/workflows/deploy.yml
@@ -19,6 +19,8 @@ env:
 jobs:
   build-and-deploy:
     runs-on: ubuntu-latest
+    env:
+      KUBECONFIG: /tmp/kubeconfig
     steps:
       - name: Validate branch ↔ environment
         run: |
@@ -87,8 +89,8 @@ jobs:
           curl -sLO "https://dl.k8s.io/release/v1.30.0/bin/linux/amd64/kubectl"
           chmod +x kubectl
           mv kubectl /usr/local/bin/
-          mkdir -p ~/.kube
-          echo "${{ secrets.KUBECONFIG_B64 }}" | base64 -d > ~/.kube/config
+          echo "${{ secrets.KUBECONFIG_B64 }}" | base64 -d > /tmp/kubeconfig
+          chmod 600 /tmp/kubeconfig
 
       - name: Create/Update imagePullSecret
         run: |