diff --git a/astro.config.mjs b/astro.config.mjs
index 8b42d4e..d307c15 100644
--- a/astro.config.mjs
+++ b/astro.config.mjs
@@ -1,4 +1,4 @@
-import { defineConfig } from "astro/config";
+import { defineConfig, envField } from "astro/config";
 import tailwind from "@astrojs/tailwind";
 import svelte from "@astrojs/svelte";
 import Icons from "unplugin-icons/vite";
@@ -70,5 +70,24 @@ export default defineConfig({
   site: "https://www.lukastrombach.dev",
   experimental: {
     actions: true,
+    env: {
+      schema: {
+        GH_TOKEN: envField.string({ context: "server", access: "secret" }),
+        PUBLIC_VERCEL_URL: envField.string({
+          context: "server",
+          access: "public",
+          optional: true,
+        }),
+        RESEND_TOKEN: envField.string({ context: "server", access: "secret" }),
+        PUBLIC_VERCEL_STORAGE_URL: envField.string({
+          context: "server",
+          access: "public",
+        }),
+        PUBLIC_CV_FILE_NAME: envField.string({
+          context: "server",
+          access: "public",
+        }),
+      },
+    },
   },
 });
diff --git a/src/env.d.ts b/src/env.d.ts
index c7aa3f0..050c6e6 100644
--- a/src/env.d.ts
+++ b/src/env.d.ts
@@ -1,22 +1,9 @@
+/// <reference path="../.astro/env.d.ts" />
 /// <reference path="../.astro/types.d.ts" />
 /// <reference path="../.astro/actions.d.ts" />
 /// <reference types="astro/client" />
 /// <reference types="svelte-gestures" />
 
-interface ImportMetaEnv {
-  GH_TOKEN: string;
-  VERCEL_ENV?: "production" | "preview" | "development";
-  VERCEL_URL?: string;
-  RESEND_TOKEN?: string;
-  ISR_BYPASS_TOKEN?: string;
-  VERCEL_STORAGE_URL?: string;
-  CV_FILE_NAME?: string;
-}
-
-interface ImportMeta {
-  readonly env: ImportMetaEnv;
-}
-
 // Workaround for icon type checking
 declare module "icons:astro/*" {
   const component: (
diff --git a/src/pages/cv.pdf.ts b/src/pages/cv.pdf.ts
index be01b8c..02880f0 100644
--- a/src/pages/cv.pdf.ts
+++ b/src/pages/cv.pdf.ts
@@ -1,18 +1,22 @@
 import type { APIRoute } from "astro";
+import {
+  PUBLIC_VERCEL_STORAGE_URL,
+  PUBLIC_CV_FILE_NAME,
+} from "astro:env/server";
 
 export const prerender = false;
 
 export const GET: APIRoute = async () => {
-  if (!import.meta.env.VERCEL_STORAGE_URL) {
+  if (!PUBLIC_VERCEL_STORAGE_URL) {
     return new Response("Vercel storage URL not set", { status: 500 });
   }
 
-  if (!import.meta.env.CV_FILE_NAME) {
+  if (!PUBLIC_CV_FILE_NAME) {
     return new Response("Missing CV file name", { status: 500 });
   }
 
   const file = await fetch(
-    new URL(import.meta.env.CV_FILE_NAME, import.meta.env.VERCEL_STORAGE_URL),
+    new URL(PUBLIC_CV_FILE_NAME, PUBLIC_VERCEL_STORAGE_URL),
   );
 
   if (file.ok) {
diff --git a/src/utils/contact.ts b/src/utils/contact.ts
index e997de1..8d63241 100644
--- a/src/utils/contact.ts
+++ b/src/utils/contact.ts
@@ -1,4 +1,5 @@
 import { ActionError } from "astro:actions";
+import { getSecret } from "astro:env/server";
 import { Resend } from "resend";
 
 export default async function sendEmail({
@@ -10,7 +11,9 @@ export default async function sendEmail({
   email: string;
   message: string;
 }) {
-  if (!import.meta.env.RESEND_TOKEN) {
+  const RESEND_TOKEN = getSecret("RESEND_TOKEN");
+
+  if (!RESEND_TOKEN) {
     const message = "Missing token";
     console.error(message);
 
@@ -20,7 +23,7 @@ export default async function sendEmail({
     });
   }
 
-  const resend = new Resend(import.meta.env.RESEND_TOKEN);
+  const resend = new Resend(RESEND_TOKEN);
   const response = await resend.emails.send({
     from: "homepage-contact@lukastrombach.dev",
     to: ["contact@lukastrombach.dev"],
diff --git a/src/utils/contributionsCalendar.ts b/src/utils/contributionsCalendar.ts
index f31d158..9ed0965 100644
--- a/src/utils/contributionsCalendar.ts
+++ b/src/utils/contributionsCalendar.ts
@@ -1,5 +1,6 @@
 import { z } from "astro/zod";
 import fetch from "./fetchHelper";
+import { getSecret } from "astro:env/server";
 
 const GH_API = "https://api.github.com/graphql";
 const USERNAME = "Trombach";
@@ -44,7 +45,9 @@ export const schema = z.object({
 });
 
 export default async function getGithubContributions() {
-  if (!import.meta.env.GH_TOKEN) {
+  const GH_TOKEN = getSecret("GH_TOKEN");
+
+  if (!GH_TOKEN) {
     throw new Error("Missing auth token.");
   }
 
@@ -52,7 +55,7 @@ export default async function getGithubContributions() {
     method: "POST",
     headers: {
       "Content-Type": "application/json",
-      Authorization: `Bearer ${import.meta.env.GH_TOKEN}`,
+      Authorization: `Bearer ${GH_TOKEN}`,
     },
     body: JSON.stringify({ query: QUERY, variables: { userName: USERNAME } }),
   });
diff --git a/src/utils/fetchHelper.ts b/src/utils/fetchHelper.ts
index be0acd8..b74798b 100644
--- a/src/utils/fetchHelper.ts
+++ b/src/utils/fetchHelper.ts
@@ -1,6 +1,7 @@
 /* global URL RequestInit fetch URLSearchParams console */
 
 import type { z } from "astro/zod";
+import { PUBLIC_VERCEL_URL } from "astro:env/server";
 
 export default async function fetchWithSchema<S extends z.ZodTypeAny>(
   schema: S,
@@ -32,8 +33,8 @@ function getURL(url: URL | string, searchParams?: { [key: string]: string }) {
   if (typeof url === "string" && url.startsWith("http")) {
     url = new URL(url);
   } else {
-    const base = import.meta.env.VERCEL_URL
-      ? `https://${import.meta.env.VERCEL_URL}`
+    const base = PUBLIC_VERCEL_URL
+      ? `https://${PUBLIC_VERCEL_URL}`
       : "http://localhost:4321";
     url = new URL(url, base);
   }