diff --git a/helmfile.d/atlantis.yaml.gotmpl b/helmfile.d/atlantis.yaml.gotmpl
index bb12c4a0..cfe9adbd 100644
--- a/helmfile.d/atlantis.yaml.gotmpl
+++ b/helmfile.d/atlantis.yaml.gotmpl
@@ -3,7 +3,7 @@ bases:
 
 repositories:
 - name: oceanbox
-  url: "git+https://gitlab-ci:glpat-WUPiu4yb5Ffx7R8dC2kZ@gitlab.com/oceanbox/manifests@charts?ref=main"
+  url: "git+https://gitlab-ci:{{ requiredEnv "CI_JOB_TOKEN" }}@gitlab.com/oceanbox/manifests@charts?ref=main"
 
 commonLabels:
   tier: system
diff --git a/helmfile.d/sorcerer.yaml.gotmpl b/helmfile.d/sorcerer.yaml.gotmpl
index 5a35d2d6..b731d962 100644
--- a/helmfile.d/sorcerer.yaml.gotmpl
+++ b/helmfile.d/sorcerer.yaml.gotmpl
@@ -3,7 +3,7 @@ bases:
 
 repositories:
 - name: oceanbox
-  url: "git+https://gitlab-ci:glpat-WUPiu4yb5Ffx7R8dC2kZ@gitlab.com/oceanbox/manifests@charts?ref=main"
+  url: "git+https://gitlab-ci:{{ requiredEnv "CI_JOB_TOKEN" }}@gitlab.com/oceanbox/manifests@charts?ref=main"
 
 commonLabels:
   tier: system
diff --git a/shell.nix b/shell.nix
index 2a52b293..6645ff23 100644
--- a/shell.nix
+++ b/shell.nix
@@ -37,4 +37,5 @@ pkgs.mkShellNoCC {
   ];
 
   ARGOCD_ENV_CLUSTER_NAME = "oceanbox";
+  CI_JOB_TOKEN = "glpat-xxx";
 }