diff --git a/.forgejo/workflows/deploy-hugo-site.yml b/.forgejo/workflows/deploy-hugo-site.yml
index ef1c680..1b17b19 100644
--- a/.forgejo/workflows/deploy-hugo-site.yml
+++ b/.forgejo/workflows/deploy-hugo-site.yml
@@ -28,9 +28,6 @@ on:
         required: false
         default: ""
         type: string
-    secrets:
-      deploy_ssh_key:
-        required: true
 
 jobs:
   deploy:
@@ -50,7 +47,7 @@ jobs:
       DEPLOY_PATH: ${{ vars.DEPLOY_PATH }}
       HUGO_PARAMS_ANALYTICS_GOOGLE_SITEVERIFICATIONTAG: ${{ vars.GOOGLE_SITE_VERIFICATION_TAG }}
       HUGO_PARAMS_TURNSTILESITEKEY: ${{ vars.TURNSTILE_SITE_KEY }}
-      HUGO_WORKER_URL: ${{ vars.WORKER_URL }}
+      HUGO_WORKER_URL: ${{ vars.HUGO_WORKER_URL }}
     steps:
       - name: Checkout repository
         uses: https://data.forgejo.org/actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5
diff --git a/README.md b/README.md
index c3d9161..703f8a7 100644
--- a/README.md
+++ b/README.md
@@ -66,6 +66,7 @@ jobs:
 Notes:
 
 - For the current caller pattern, `DEPLOY_SSH_HOST`, `DEPLOY_SSH_USER`, and `DEPLOY_PATH` are required repo variables unless the caller explicitly passes host and user as workflow inputs
+- Caller repos pass `DEPLOY_SSH_KEY` through `jobs.<job_id>.secrets`; Forgejo v11 accepts caller-provided reusable workflow secrets even though `on.workflow_call` itself only documents `inputs` and `outputs`
 - Caller repos can set `DEPLOY_KNOWN_HOSTS` in repo variables with a pinned `known_hosts` entry for stronger host verification
 - If `DEPLOY_KNOWN_HOSTS` is not set, the workflow falls back to `ssh-keyscan` so current repos keep working
 - The reusable workflow itself always runs on `docker-desktop`