diff --git a/.woodpecker/deploy.yml b/.woodpecker/deploy.yml
index 93a2bdf..87d302f 100644
--- a/.woodpecker/deploy.yml
+++ b/.woodpecker/deploy.yml
@@ -170,8 +170,14 @@ steps:
                 create_or_update_secret 'productivity_db_password'          '${PRODUCTIVITY_DB_PASSWORD}'
                 create_or_update_secret 'productivity_oidc_providers'       '${PRODUCTIVITY_OIDC_PROVIDERS}'";;
             vaultwarden)
-              printf '%s' "${VAULTWARDEN_ADMIN_TOKEN}"  | ssh -o StrictHostKeyChecking=no root@${SWARM_MANAGER_IP} "docker secret rm vaultwarden_admin_token  2>/dev/null; docker secret create vaultwarden_admin_token -"
-              printf '%s' "${VAULTWARDEN_DATABASE_URL}" | ssh -o StrictHostKeyChecking=no root@${SWARM_MANAGER_IP} "docker secret rm vaultwarden_database_url 2>/dev/null; docker secret create vaultwarden_database_url -";;
+              # NOTE: vaultwarden_database_url cannot be rotated in-place — Swarm refuses
+              # to `docker secret rm` a secret referenced by a running service's spec.
+              # We provision under a versioned name (_v2) instead; vaultwarden.yaml maps
+              # it back to the same in-container filename via `target:`. The old secret
+              # is removed manually once the compose file cutover is confirmed healthy.
+              ssh -o StrictHostKeyChecking=no root@${SWARM_MANAGER_IP} "source /tmp/cs.sh
+                create_or_update_secret 'vaultwarden_admin_token'     '${VAULTWARDEN_ADMIN_TOKEN}'
+                create_or_update_secret 'vaultwarden_database_url_v2' '${VAULTWARDEN_DATABASE_URL}'";;
             ai)
               echo "  No Docker secrets for ai -- secrets in host .env";;
             entertainment)