diff --git a/.woodpecker.yml b/.woodpecker.yml
index 591a625..54c4ba3 100644
--- a/.woodpecker.yml
+++ b/.woodpecker.yml
@@ -85,8 +85,7 @@ steps:
       ANSIBLE_CONFIG: ansible.cfg
       SSH_PRIVATE_KEY:
         from_secret: SSH_PRIVATE_KEY
-      PUSHGATEWAY_URL:
-        from_secret: PUSHGATEWAY_URL
+      PUSHGATEWAY_URL: http://pushgateway.observability-stack.svc.cluster.local:9091
     commands:
       - |
         apk add --no-cache curl > /dev/null 2>&1
@@ -136,8 +135,9 @@ steps:
 #
 # Required secrets (Woodpecker → Repository Settings → Secrets):
 #   SSH_PRIVATE_KEY  – SSH key to reach the managed server
-#   PUSHGATEWAY_URL  – Base URL of Prometheus Pushgateway
-#                      e.g. http://pushgateway:9091
+#
+# Pushgateway URL is hardcoded (internal k8s service, not a secret):
+#   http://pushgateway.observability-stack.svc.cluster.local:9091
 # =============================================================================
 when:
   event: cron
@@ -155,8 +155,7 @@ steps:
       ANSIBLE_CONFIG: ansible.cfg
       SSH_PRIVATE_KEY:
         from_secret: SSH_PRIVATE_KEY
-      PUSHGATEWAY_URL:
-        from_secret: PUSHGATEWAY_URL
+      PUSHGATEWAY_URL: http://pushgateway.observability-stack.svc.cluster.local:9091
     commands:
       - |
         apk add --no-cache curl > /dev/null 2>&1