diff --git a/.travis.yml b/.travis.yml
index 2b58731727..395fc89a5e 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -8,8 +8,6 @@ before_install:
 - docker version
 - sh -v travis/runcontainer.sh oracle db2
 - docker ps
-- openssl aes-256-cbc -K $encrypted_c3c0a1170361_key -iv $encrypted_c3c0a1170361_iv
-  -in secrets.tar.enc -out secrets.tar -d
 jdk:
   - oraclejdk8
 notifications:
@@ -31,5 +29,5 @@ script:
 - admin/build.sh
 cache:
   directories:
-    - $HOME/.sbt
-    - $HOME/.ivy2
+    - "$HOME/.sbt"
+    - "$HOME/.ivy2"
diff --git a/admin/build.sh b/admin/build.sh
index 27a0a07bdd..e8d8112418 100755
--- a/admin/build.sh
+++ b/admin/build.sh
@@ -3,8 +3,9 @@
 # Setup:
 # - Copy keys to admin/secring.asc, admin/pubring.asc
 #   - Use a new key pair per repository
-# - Copy deploykey and deploykey.pub to admin/
-# - ssh-keygen -t rsa -b 4096 -C "<github-user-email>"
+# - ssh-keygen -t rsa -b 4096 -C "<github-user-email>" #save as deploykey
+#   - Setup github deploy keys using generated keys, keep a copy of generated keys
+# - cp deploykey deploykey.pub admin/
 # - openssl rsa -in admin/deploykey -outform pem > admin/deploykey.pem
 # - chmod 400 admin/deploykey.pem
 # - cp ~/.sbt/sonatype.sbt ./
@@ -16,6 +17,7 @@ set -e
 
 if [[ "$TRAVIS_TAG" =~ ^v[0-9]+\.[0-9]+(\.[0-9]+)?(-[A-Za-z0-9-]+)? ]]; then
   echo "Going to release from tag $TRAVIS_TAG!"
+  openssl aes-256-cbc -K $encrypted_c3c0a1170361_key -iv $encrypted_c3c0a1170361_iv -in secrets.tar.enc -out secrets.tar -d
   myVer=$(echo $TRAVIS_TAG | sed -e s/^v//)
   publishVersion='set every version := "'$myVer'"'
   extraTarget="+publishSigned +makeSite"