diff --git a/.gitea/workflows/ci.yml b/.gitea/workflows/ci.yml
index b919aee..b191b97 100644
--- a/.gitea/workflows/ci.yml
+++ b/.gitea/workflows/ci.yml
@@ -28,7 +28,5 @@ jobs:
 
       - name: Set up
         run: ./scripts/ansible/setup.sh
-      - name: Pretend executable is vault password
-        run: chmod -x ansible/vault-pass.sh
       - name: Lint
         run: ./scripts/ansible/lint.sh
diff --git a/ansible/ansible.cfg b/ansible/ansible.cfg
index b3bf7cb..be908ea 100644
--- a/ansible/ansible.cfg
+++ b/ansible/ansible.cfg
@@ -7,7 +7,6 @@ collections_path = $PWD/galaxy_collections
 inventory = ./hosts
 become_ask_pass = True
 interpreter_python = auto_silent
-vault_password_file = ./vault-pass.sh
 
 [ssh_connection]
 pipelining = True
diff --git a/scripts/ansible/deploy.sh b/scripts/ansible/deploy.sh
index 9c7f847..5101172 100755
--- a/scripts/ansible/deploy.sh
+++ b/scripts/ansible/deploy.sh
@@ -4,4 +4,4 @@ set -ex
 
 cd ansible/
 
-time ansible-playbook main.yml -K $@
+time ansible-playbook main.yml --vault-password-file=vault-pass.sh -K $@