diff --git a/apps/web/lib/server.ts b/apps/web/lib/server.ts
index c4badc574b..c263de730f 100644
--- a/apps/web/lib/server.ts
+++ b/apps/web/lib/server.ts
@@ -1,6 +1,7 @@
 import "server-only";
 
 import { decrypt } from "@cap/database/crypto";
+import { serverEnv } from "@cap/env";
 import {
 	AwsCredentials,
 	Database,
@@ -36,7 +37,6 @@ import {
 	Redacted,
 } from "effect";
 import { cookies } from "next/headers";
-
 import { allowedOrigins } from "@/utils/cors";
 import { layerTracer } from "./tracing";
 
@@ -56,10 +56,9 @@ const CookiePasswordAttachmentLive = Layer.effect(
 class WorkflowRpcSecret extends Effect.Service<WorkflowRpcSecret>()(
 	"WorkflowRpcSecret",
 	{
-		effect: Effect.map(
-			Config.redacted(Config.string("WORKFLOWS_RPC_SECRET")),
-			(v) => ({ authSecret: v }),
-		),
+		sync: () => ({
+			authSecret: Redacted.make(serverEnv().WORKFLOWS_RPC_SECRET),
+		}),
 	},
 ) {}
 
diff --git a/packages/env/server.ts b/packages/env/server.ts
index 242b95d377..f580818472 100644
--- a/packages/env/server.ts
+++ b/packages/env/server.ts
@@ -67,8 +67,8 @@ function createServerEnv() {
 			S3_PUBLIC_ENDPOINT: z.string().optional(),
 			S3_INTERNAL_ENDPOINT: z.string().optional(),
 			VERCEL_AWS_ROLE_ARN: z.string().optional(),
-			REMOTE_WORKFLOW_URL: z.string().optional(),
-			REMOTE_WORKFLOW_SECRET: z.string().optional(),
+			WORKFLOWS_RPC_URL: z.string().optional(),
+			WORKFLOWS_RPC_SECRET: z.string(),
 		},
 		experimental__runtimeEnv: {
 			...process.env,