diff --git a/.forgejo/workflows/grade.yml b/.forgejo/workflows/grade.yml
index 790f3be..ac8daa3 100644
--- a/.forgejo/workflows/grade.yml
+++ b/.forgejo/workflows/grade.yml
@@ -2,37 +2,25 @@ name: grade
 on: [push]
 
 # Production wiring (forgejo-runner on ghost):
-#   - forgejo-runner v13: docker_host: automount -> the job container gets the
-#     host docker socket, so docker_grade.sh drives the host daemon as designed
-#   - hidden tests mount from the runner host via the nested docker run
-#     (-v /opt/grade-hidden/...) — never in this repo
-#   - GRADE_HMAC_SECRET is a Forgejo org/repo Actions secret (set via API),
-#     injected with ${{ secrets.GRADE_HMAC_SECRET }}
+#   - forgejo-runner v13 config: docker_host: automount -> the job container
+#     gets the host docker socket, so `docker run` drives the host daemon
+#   - the nested grade container mounts the secret + hidden tests straight from
+#     the host (/opt/grade/grade.env, /opt/grade-hidden/...) — never in this
+#     repo, no job-container options, no Actions secrets required
 jobs:
   grade:
     runs-on: docker
     container:
       image: gitea/runner-images:ubuntu-22.04
-      options: -v /opt/grade/runner-diag:/diag
     steps:
       - uses: actions/checkout@v4
       - name: Grade (blank fails, solved passes)
-        env:
-          GRADE_HMAC_SECRET: ${{ secrets.GRADE_HMAC_SECRET }}
         run: |
-          LOG=/diag/$(date +%s).log
-          {
-            echo "PWD=$PWD"; echo "secret-len=${#GRADE_HMAC_SECRET}"
-            docker images | grep -E "grade-(c|harness)" || echo "NO GRADE IMAGES"
-            ls -la /opt/grade-hidden/cs2060/record-manager/ 2>&1 | head -3
-            docker run --rm --network=none \
-              -v "$PWD":/work \
-              -v /opt/grade-hidden/cs2060/record-manager:/hidden:ro \
-              -e GRADE_HMAC_SECRET \
-              grade-c:dev \
-              python3 /opt/grade/grade_cli.py run \
-                --student /work --hidden /hidden \
-                --course CS2060 --assignment record-manager \
-                --out /work/results.json 2>&1 | tail -20
-          } > "$LOG" 2>&1 || true
-          head -c 400 "$LOG"
+          docker run --rm --network=none \
+            -v "$PWD":/work \
+            -v /opt/grade/grade.env:/run/secrets/grade.env:ro \
+            -v /opt/grade-hidden/cs2060/record-manager:/hidden:ro \
+            grade-c:dev \
+            sh -c 'set -a; . /run/secrets/grade.env; set +a; python3 /opt/grade/grade_cli.py run --student /work --hidden /hidden --course CS2060 --assignment record-manager --out /work/results.json'
+          echo "--- signed result summary ---"
+          head -c 400 results.json