diff --git a/.goreleaser.yaml b/.goreleaser.yaml
index 1ba324d..442a8dd 100644
--- a/.goreleaser.yaml
+++ b/.goreleaser.yaml
@@ -103,14 +103,7 @@ changelog:
 
 publishers:
   - name: atproto-pds
-    cmd: ./scripts/publish-artifact.sh
-    env:
-      - APP_PASSWORD={{ .Env.APP_PASSWORD }}
-      - TANGLED_REPO_DID={{ .Env.TANGLED_REPO_DID }}
-      - TANGLED_REF_NAME={{ .Env.TANGLED_REF_NAME }}
-      - REPO_URL={{ .Env.REPO_URL }}
-      - ARTIFACT_PATH={{ abs .ArtifactPath }}
-      - ARTIFACT_NAME={{ .ArtifactName }}
+    cmd: ./scripts/publish-artifact.sh "{{ abs .ArtifactPath }}" "{{ .ArtifactName }}"
 
 # Disable since not using GitHub
 release:
diff --git a/scripts/publish-artifact.sh b/scripts/publish-artifact.sh
index 9ddbeae..ee8478f 100755
--- a/scripts/publish-artifact.sh
+++ b/scripts/publish-artifact.sh
@@ -1,6 +1,9 @@
 #!/usr/bin/env bash
 set -e
 
+ARTIFACT_PATH="$1"
+ARTIFACT_NAME="$2"
+
 # Serialize across parallel invocations from goreleaser to avoid slamming the
 # PDS with simultaneous uploads. `goat account login` happens once in the
 # release workflow before goreleaser runs, so this script just reuses the