diff --git a/.github/workflows/docs.yml b/.github/workflows/docs.yml
index 090d44c588..9d4a6c62b6 100644
--- a/.github/workflows/docs.yml
+++ b/.github/workflows/docs.yml
@@ -15,6 +15,11 @@ on:
         required: false
         type: string
         default: '0.0.1-dev'
+    secrets:
+      CLOUDFLARE_API_TOKEN:
+        required: false
+      CLOUDFLARE_ACCOUNT_ID:
+        required: false
   workflow_dispatch:
     inputs:
       deploy:
diff --git a/.github/workflows/release-preview.yml b/.github/workflows/release-preview.yml
index abd54e8818..d024f5b2c2 100644
--- a/.github/workflows/release-preview.yml
+++ b/.github/workflows/release-preview.yml
@@ -12,6 +12,8 @@ on:
 jobs:
   test:
     uses: ./.github/workflows/test.yml
+    secrets:
+      CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}
 
   release-preview:
     if: ${{ inputs.create_preview_release }}
@@ -20,7 +22,7 @@ jobs:
     with:
       environment: next
     secrets:
-      nuget_api_key: ${{ secrets.NUGET_API_TOKEN }}
+      NUGET_API_TOKEN: ${{ secrets.NUGET_API_TOKEN }}
 
   docs:
     uses: ./.github/workflows/docs.yml
@@ -29,6 +31,9 @@ jobs:
       deploy: true
       environment: next
       version: ${{ needs.release-preview.outputs.version }}
+    secrets:
+      CLOUDFLARE_ACCOUNT_ID: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}
+      CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}
 
   release-stable-update-branch:
     runs-on: ubuntu-latest
diff --git a/.github/workflows/release-stable.yml b/.github/workflows/release-stable.yml
index 18ea1e4a41..b58fc73d2b 100644
--- a/.github/workflows/release-stable.yml
+++ b/.github/workflows/release-stable.yml
@@ -6,6 +6,8 @@ on:
 jobs:
   test:
     uses: ./.github/workflows/test.yml
+    secrets:
+      CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}
 
   release:
     needs: test
@@ -13,7 +15,7 @@ jobs:
     with:
       environment: stable
     secrets:
-      nuget_api_key: ${{ secrets.NUGET_API_TOKEN }}
+      NUGET_API_TOKEN: ${{ secrets.NUGET_API_TOKEN }}
 
   docs:
     uses: ./.github/workflows/docs.yml
@@ -22,3 +24,6 @@ jobs:
       deploy: true
       environment: stable
       version: ${{ needs.release.outputs.version }}
+    secrets:
+      CLOUDFLARE_ACCOUNT_ID: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}
+      CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 2dfa4d985d..2c86107633 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -11,7 +11,7 @@ on:
         required: true
         type: string
     secrets:
-      nuget_api_key:
+      NUGET_API_TOKEN:
         required: true
     outputs:
       version:
@@ -49,7 +49,7 @@ jobs:
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           NUGET_SOURCE: ${{ inputs.nuget_source }}
-          NUGET_API_KEY: ${{ secrets.nuget_api_key }}
+          NUGET_API_TOKEN: ${{ secrets.NUGET_API_TOKEN }}
           MAPPERLY_ENVIRONMENT: ${{ inputs.environment }}
       - id: release-version
         run: echo "version=${{ env.RELEASE_VERSION }}" >> "$GITHUB_OUTPUT"
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index 8998b359fa..5910ab3be7 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -2,6 +2,9 @@ name: test
 
 on:
   workflow_call:
+    secrets:
+      CODECOV_TOKEN:
+        required: false
   pull_request:
     branches:
       - '**'
diff --git a/.releaserc.yaml b/.releaserc.yaml
index 2aff36f7b1..e22aa765cb 100644
--- a/.releaserc.yaml
+++ b/.releaserc.yaml
@@ -14,4 +14,4 @@ plugins:
   - - "@semantic-release/exec"
     - verifyReleaseCmd: "echo RELEASE_VERSION=\"${nextRelease.version}\" >> $GITHUB_ENV"
       prepareCmd: "RELEASE_NOTES=\"${nextRelease.notes}\" RELEASE_VERSION=\"${nextRelease.version}\" ./build/package.sh"
-      publishCmd: "dotnet nuget push './artifacts/*.nupkg' --source $NUGET_SOURCE --api-key $NUGET_API_KEY"
+      publishCmd: "dotnet nuget push './artifacts/*.nupkg' --source $NUGET_SOURCE --api-key $NUGET_API_TOKEN"