diff --git a/.woodpecker/keycloak.yaml b/.woodpecker/keycloak.yaml
index 5c3433a..06eed66 100644
--- a/.woodpecker/keycloak.yaml
+++ b/.woodpecker/keycloak.yaml
@@ -19,8 +19,7 @@ workspace:
 # Also because global environment variables aren't a thing.
 matrix:
   KEYCLOAK_VERSION:
-    - 26.1
-    - 26.2
+    - 25.0
   IMAGE_NAME:
   - git.hamburg.ccc.de/ccchh/oci-images/keycloak
 
@@ -43,9 +42,8 @@ steps:
 
   - name: publish-image
     image: alpine
-    environment:
-      GIT_API_TOKEN:
-        from_secret: GIT_API_TOKEN
+    secrets:
+      - GIT_API_TOKEN
     commands:
       - apk -u add crane
       - crane auth login git.hamburg.ccc.de -u woodpecker -p $GIT_API_TOKEN
@@ -55,9 +53,8 @@ steps:
     image: alpine
     when:
       - branch: main
-    environment:
-      GIT_API_TOKEN:
-        from_secret: GIT_API_TOKEN
+    secrets:
+      - GIT_API_TOKEN
     commands:
       - apk -u add crane
       - crane auth login git.hamburg.ccc.de -u woodpecker -p $GIT_API_TOKEN
@@ -67,10 +64,9 @@ steps:
     image: alpine
     when:
       - branch: main
-        evaluate: 'KEYCLOAK_VERSION == "26.0"'
-    environment:
-      GIT_API_TOKEN:
-        from_secret: GIT_API_TOKEN
+        evaluate: 'KEYCLOAK_VERSION == "25.0"'
+    secrets:
+      - GIT_API_TOKEN
     commands:
       - apk -u add crane
       - crane auth login git.hamburg.ccc.de -u woodpecker -p $GIT_API_TOKEN
diff --git a/.woodpecker/nextcloud.yaml b/.woodpecker/nextcloud.yaml
index d570293..feea22e 100644
--- a/.woodpecker/nextcloud.yaml
+++ b/.woodpecker/nextcloud.yaml
@@ -19,8 +19,8 @@ workspace:
 # Also because global environment variables aren't a thing.
 matrix:
   NEXTCLOUD_VERSION:
-    - 30
-    - 31
+    - 28
+    - 29
   IMAGE_NAME:
     - git.hamburg.ccc.de/ccchh/oci-images/nextcloud
 
@@ -43,9 +43,8 @@ steps:
 
   - name: publish-image
     image: docker.io/library/alpine
-    environment:
-      GIT_API_TOKEN:
-        from_secret: GIT_API_TOKEN
+    secrets:
+      - GIT_API_TOKEN
     commands:
       - apk -u add crane
       - crane auth login git.hamburg.ccc.de -u woodpecker -p $GIT_API_TOKEN
@@ -55,9 +54,8 @@ steps:
     image: docker.io/library/alpine
     when:
       - branch: main
-    environment:
-      GIT_API_TOKEN:
-        from_secret: GIT_API_TOKEN
+    secrets:
+      - GIT_API_TOKEN
     commands:
       - apk -u add crane
       - crane auth login git.hamburg.ccc.de -u woodpecker -p $GIT_API_TOKEN
@@ -67,10 +65,9 @@ steps:
     image: docker.io/library/alpine
     when:
       - branch: main
-        evaluate: 'NEXTCLOUD_VERSION == "29"'
-    environment:
-      GIT_API_TOKEN:
-        from_secret: GIT_API_TOKEN
+        evaluate: 'NEXTCLOUD_VERSION == "28"'
+    secrets:
+      - GIT_API_TOKEN
     commands:
       - apk -u add crane
       - crane auth login git.hamburg.ccc.de -u woodpecker -p $GIT_API_TOKEN
diff --git a/.woodpecker/penpot.yaml b/.woodpecker/penpot.yaml
index 8cedcbe..6bb8e0a 100644
--- a/.woodpecker/penpot.yaml
+++ b/.woodpecker/penpot.yaml
@@ -44,10 +44,7 @@ steps:
       # https://github.com/penpot/penpot/pull/4945
       # https://github.com/penpot/penpot/pull/4945/commits/752574bac789cc90cc218004bb9545cc6239895d
       - curl https://github.com/penpot/penpot/commit/752574bac789cc90cc218004bb9545cc6239895d.patch > 0001-move-entire-image-build-process-into-Dockerfiles.patch
-      # Get patch disallowing registration with invitation token, when disable-login-with-password flag is set.
-      # https://github.com/penpot/penpot/issues/4975
-      # https://github.com/june128/penpot/commit/f799da132bf5a51015859031f45154172fbf7cd0
-      - curl https://github.com/june128/penpot/commit/f799da132bf5a51015859031f45154172fbf7cd0.patch > 0002-hotfix-dont-allow-registration-with-invite-if-password-login-is-disabled.patch
+      - curl https://github.com/june128/penpot/commit/4d5c787478ddc612aec4d25b2f059d63a226a6d1.patch > 0002-testing.patch
       - git config user.name "Woodpecker"
       - git config user.email "woodpecker@woodpecker.invalid"
       - git am *.patch
@@ -64,9 +61,8 @@ steps:
 
   - name: publish-image
     image: docker.io/library/alpine
-    environment:
-      GIT_API_TOKEN:
-        from_secret: GIT_API_TOKEN
+    secrets:
+      - GIT_API_TOKEN
     commands:
       - apk -u add crane
       - crane auth login git.hamburg.ccc.de -u woodpecker -p $GIT_API_TOKEN
@@ -76,9 +72,8 @@ steps:
     image: docker.io/library/alpine
     when:
       - branch: main
-    environment:
-      GIT_API_TOKEN:
-        from_secret: GIT_API_TOKEN
+    secrets:
+      - GIT_API_TOKEN
     commands:
       - apk -u add crane
       - crane auth login git.hamburg.ccc.de -u woodpecker -p $GIT_API_TOKEN
@@ -89,9 +84,8 @@ steps:
     when:
       - branch: main
         evaluate: 'PENPOT_VERSION == "2.1.2"'
-    environment:
-      GIT_API_TOKEN:
-        from_secret: GIT_API_TOKEN
+    secrets:
+      - GIT_API_TOKEN
     commands:
       - apk -u add crane
       - crane auth login git.hamburg.ccc.de -u woodpecker -p $GIT_API_TOKEN