diff --git a/.github/workflows/test_and_release.yml b/.github/workflows/test_and_release.yml
index 183cd6c..1b6b004 100644
--- a/.github/workflows/test_and_release.yml
+++ b/.github/workflows/test_and_release.yml
@@ -70,12 +70,13 @@ jobs:
         SONA_USER: ${{ secrets.SONATYPE_USERNAME }}
         SONA_PASS: ${{ secrets.SONATYPE_PASSWORD }}
         PGP_SECRET: ${{ secrets.PGP_SECRET }}
-        PGP_PASS: ${{ secrets.PGP_PASS }}
+        PGP_PASSPHRASE: ${{ secrets.PGP_PASSPHRASE }}
+        PGP_KEY_HEX: ${{ secrets.PGP_KEY_HEX }}
         CI: github
       run: |
         git fetch --prune --unshallow --tags &&
         export GPG_TTY=$(tty) &&
-        echo $PGP_SECRET | base64 -d | gpg --passphrase=$PGP_PASS --yes --batch --pinentry-mode loopback --import &&
+        echo $PGP_SECRET | base64 -d | gpg --passphrase=$PGP_PASSPHRASE --yes --batch --pinentry-mode loopback --import &&
         export PATH=`pwd`/.github/bin:$PATH &&
         sbt + test ciReleaseTagNextVersion ciReleaseSonatype
 
diff --git a/build.sbt b/build.sbt
index 1b00240..af7cc1f 100644
--- a/build.sbt
+++ b/build.sbt
@@ -72,7 +72,7 @@ lazy val publishSettings = Seq(
     Developer("BorisDuedder", "Boris Düdder", "boris.d@di.ku.dk", url("http://duedder.net"))
   ),
   publishTo := sonatypePublishToBundle.value,
-)
+) ++ sys.env.get("PGP_KEY_HEX").map(h => usePgpKeyHex(h)).seq
 
 lazy val noPublishSettings = Seq(
   publish := Seq.empty,