diff --git a/.woodpecker.yml b/.woodpecker.yml
index 0e6a11f..e59963c 100644
--- a/.woodpecker.yml
+++ b/.woodpecker.yml
@@ -39,12 +39,6 @@ steps:
         from_secret: git_runner_token
       GIT_MCP_ACCESS_TOKEN:
         from_secret: git_mcp_access_token
-      GUACAMOLE_LDAP_BIND_PASSWORD:
-        from_secret: guacamole_ldap_bind_password
-      GUACAMOLE_OIDC_CLIENT_SECRET:
-        from_secret: guacamole_oidc_client_secret
-      GUACAMOLE_DB_PASSWORD:
-        from_secret: guacamole_db_password
       HOMEASSISTANT_FRIGATE_RTSP_PASSWORD:
         from_secret: homeassistant_frigate_rtsp_password
       HOMEASSISTANT_IMMICH_API_KEY:
@@ -141,8 +135,8 @@ steps:
           STACK=$(basename "$f" .yaml)
           echo "Provisioning: $STACK"
           case "$STACK" in
-            maintenance|media|unifi)
-              echo "  No secrets for $STACK";;
+            maintenance|media|unifi|guacamole)
+              echo "  No Docker secrets for $STACK — secrets in host .env";;
             woodpecker)
               echo "  Manual only - skipping";;
             3dprint)
@@ -165,11 +159,6 @@ steps:
               ssh -o StrictHostKeyChecking=no root@${SWARM_MANAGER_IP} "source /tmp/cs.sh
                 create_or_update_secret 'homeassistant_frigate_rtsp_password' '${HOMEASSISTANT_FRIGATE_RTSP_PASSWORD}'
                 create_or_update_secret 'homeassistant_immich_api_key'        '${HOMEASSISTANT_IMMICH_API_KEY}'";;
-            guacamole)
-              ssh -o StrictHostKeyChecking=no root@${SWARM_MANAGER_IP} "source /tmp/cs.sh
-                create_or_update_secret 'guacamole_ldap_bind_password' '${GUACAMOLE_LDAP_BIND_PASSWORD}'
-                create_or_update_secret 'guacamole_oidc_client_secret' '${GUACAMOLE_OIDC_CLIENT_SECRET}'
-                create_or_update_secret 'guacamole_db_password'        '${GUACAMOLE_DB_PASSWORD}'";;
             mealie)
               ssh -o StrictHostKeyChecking=no root@${SWARM_MANAGER_IP} "source /tmp/cs.sh
                 create_or_update_secret 'mealie_db_password'         '${MEALIE_DB_PASSWORD}'