diff --git a/.gitea/workflows/ci.yml b/.gitea/workflows/ci.yml
index 7a1438a..1619b98 100644
--- a/.gitea/workflows/ci.yml
+++ b/.gitea/workflows/ci.yml
@@ -8,7 +8,7 @@ jobs:
       - uses: actions/checkout@v3
       - name: Setup Terraform
         uses: hashicorp/setup-terraform@v2
-      - uses: extractions/setup-just@v1
+      - uses: taiki-e/install-action@just
       - name: Init
         run: just terraform init -backend=false
       - name: Lint
@@ -22,7 +22,7 @@ jobs:
         uses: actions/setup-python@v4
         with:
           python-version: 3.11
-      - uses: extractions/setup-just@v1
+      - uses: taiki-e/install-action@just
 
       # HACK: https://docs.ansible.com/ansible/devel/reference_appendices/config.html#cfg-in-world-writable-dir
       - name: Fix permissions
diff --git a/README.md b/README.md
index d56f2b6..780529f 100644
--- a/README.md
+++ b/README.md
@@ -16,9 +16,7 @@
 
 Ansible [integrates](https://theorangeone.net/posts/ansible-vault-bitwarden/) with Bitwarden through its [CLI](https://bitwarden.com/help/article/cli/).
 
-Terraform configuration needs to be placed in `terraform/secrets.auto.tfvars`.
-
-Terraform backend secrets need to be placed in `terraform/secrets.sh`.
+Terraform secrets are stored in `terraform/.env`, and provisioned using `just update-secrets`.
 
 ## Deploying