diff --git a/.gitea/workflows/authentik-apps.yaml b/.gitea/workflows/authentik-apps.yaml
index dda2b11..8c8ec94 100644
--- a/.gitea/workflows/authentik-apps.yaml
+++ b/.gitea/workflows/authentik-apps.yaml
@@ -30,9 +30,11 @@ jobs:
         cli_config_credentials_token: ${{ secrets.TF_API_TOKEN }}
 
     - name: Setup kubeconfig
+      env:
+        CI_KUBECONFIG: ${{ secrets.KUBECONFIG }}
       run: |
         mkdir -p ~/.kube
-        echo "${{ secrets.KUBECONFIG }}" > ~/.kube/config
+        printf '%s' "$CI_KUBECONFIG" > ~/.kube/config
         chmod 600 ~/.kube/config
 
     - name: Terraform Init
diff --git a/terraform/keycloak/providers.tf b/terraform/keycloak/providers.tf
index 3799cd2..0bf65d8 100644
--- a/terraform/keycloak/providers.tf
+++ b/terraform/keycloak/providers.tf
@@ -19,5 +19,6 @@ provider "keycloak" {
 }
 
 provider "kubernetes" {
+  # CI supplies the current cluster context through its KUBECONFIG secret.
   config_path = "~/.kube/config"
 }